Simply Schedule Appointments EUVD-2026-53964

No special conditions - remote unauthenticated exploitation against default configurations of Simply Schedule Appointments (the CVSS vector is AV:N/AC:L/PR:N/UI:N), requiring only network reachability to a WordPress site with the plugin active at version ≤ 1.6.12.10. The primary limiting factor is that the vulnerable plugin must be installed and activated with its public booking endpoints exposed; exploitation is bounded to confidentiality-style database reads per the vendor's I:N scoring, and the exact injectable endpoint/parameter is not specified in the available data, so the concrete injection point should be confirmed from the Patchstack advisory.

The signals point to a genuine high priority rather than a paper-tiger high-CVSS finding. The CVSS 3.1 base is 9.3 with AV:N/AC:L/PR:N/UI:N - fully remote, low complexity, no authentication, no user interaction - the easiest-to-reach profile that exists, and the scope change (S:C) with C:H reflects the ability to read data beyond the immediately vulnerable component. Working against elevated urgency: it is NOT in CISA KEV (no confirmed active exploitation), no public exploit code was identified, and no EPSS probability was supplied, so real-world exploitation volume cannot be quantified from the data given. One inconsistency to verify: the vendor scored I:N and A:L, which is conservative for SQL injection (many SQLi flaws also permit writes or DBMS load impact) - treat integrity/availability impact as vendor-asserted, and note that read-only data exfiltration is the confirmed primary risk. Overall: an unauthenticated, low-complexity database-read flaw in an internet-facing WordPress plugin should be patched promptly even absent KEV/POC signals.

An anonymous attacker discovers a WordPress site running Simply Schedule Appointments ≤ 1.6.12.10 and sends a crafted request to one of the plugin's public booking/availability endpoints with a malicious value in an injectable parameter. The backend concatenates the value into a SQL query, and the attacker uses UNION-based or blind techniques to dump wp_users credentials, session secrets, or other sensitive rows - all without authenticating. No public POC was identified, but the low attack complexity (AC:L) makes independent exploit development straightforward.