EUVD-2026-43424Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate WordPress plugins to confirm vulnerable version
-
DeliverySend unauthenticated HTTP request to unprotected endpoint
-
ExploitBypass missing authorization check
-
ExecutionManipulate appointment records
-
ImpactDisrupt scheduling operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond plugin installation - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against any WordPress site with Simply Schedule Appointments version 1.6.12.4 or earlier installed and active. Exploitation is limited to integrity and availability impacts on appointment data (C:N in CVSS); no credential theft or site takeover is indicated. The scope is unchanged (S:U), meaning exploitation is contained to the WordPress application itself and does not propagate to underlying infrastructure. Exploitation is further bounded by requiring the plugin to be active - deactivating the plugin removes the vulnerable endpoints entirely. |
| Impact | The NVD-assigned CVSS 3.1 base score of 6.5 (Medium) is supported by a network-accessible, unauthenticated, low-complexity attack with dual low-severity impacts on integrity and availability. No confidentiality impact is scored (C:N), which is consistent with appointment-manipulation rather than data exfiltration. No EPSS score is available in the provided data to quantify exploitation probability. KEV status is negative and no public proof-of-concept code has been identified, meaning real-world exploitation risk is currently speculative. The primary risk driver is the PR:N/AC:L combination: any internet-facing WordPress site running the vulnerable plugin version is a candidate for opportunistic scanning and manipulation of appointment records. The limited C:N rating keeps this out of high-priority triage for environments where appointment data is not sensitive, but booking disruption or spam appointment creation may carry operational consequences for businesses relying on the scheduler. |
| Exploit ScenarioDerived | An unauthenticated attacker scans for WordPress sites running Simply Schedule Appointments and identifies a vulnerable installation via plugin enumeration. The attacker sends a crafted HTTP POST request to the plugin's unprotected AJAX or REST endpoint, bypassing the missing authorization check to create, modify, or delete appointment records without any credentials. This could result in appointment slot flooding, cancellation of legitimate bookings, or disruption of business scheduling operations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Unauthenticated broken access control in the Simply Schedule Appointments WordPress plugin (versions through 1.6.12.4) allows remote attackers to perform unauthorized actions against appointment data, resulting in low-integrity and low-availability impacts. The plugin by NSquared fails to enforce proper authorization checks on one or more endpoints, enabling exploitation without any credentials against default installations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero privilege requirement lower the barrier for opportunistic abuse.
RemediationAI
Update Simply Schedule Appointments to the first release published after version 1.6.12.4 - the exact patched version number is not confirmed in the available data (patch available per vendor/Patchstack advisory; released patched version not independently verified). Site administrators should check the WordPress plugin repository or https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/ for the current safe release and apply it immediately. If upgrading is temporarily not possible, a compensating control is to restrict access to WordPress AJAX and REST API endpoints at the web server or WAF layer for unauthenticated requests, though this may break legitimate front-end booking functionality. Alternatively, placing the site behind authentication (e.g., HTTP Basic Auth at the web server level) for anonymous visitors would eliminate the unauthenticated attack surface, at the cost of blocking public booking access. Monitoring WordPress access logs for anomalous POST requests to wp-admin/admin-ajax.php or /wp-json/ from unexpected IPs can aid in detecting exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Simply Schedule Appointments (CPE: cpe:2.3:a:nsquared:simply_schedule_appointments:*:*:*:*:*:*:*:*) is a WordPress plugin providing appointment booking and calendar management functionality. The root cause is CWE-862 (Missing Authorization), a class of flaw where server-side code performs a sensitive operation - such as creating, modifying, or canceling appointments - without verifying that the requesting party holds the necessary role or capability. In WordPress, this typically manifests as AJAX handlers or REST API endpoints registered without capability checks (e.g., missing current_user_can() calls or nonce/role validation). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over HTTP without credentials or user interaction, placing it in the category of externally exploitable broken access control as described by OWASP A01:2021.
Know when Simply Schedule Appointments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable unauthenticated endpoint with no user interaction; integrity and availability impacts limited to appointment data, no confidentiality breach.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Simply Schedule Appointments
View allSimply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated us
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user inpu
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject ar
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote a
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing u
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauth
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
GitHub PoC
Exploit-DB