Croixhaug
Monthly
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11.8) allows unauthenticated remote attackers to extract sensitive database contents through the 'append_where_sql' parameter on the /appointments/bulk REST endpoint. The endpoint's permission check accepts a public nonce embedded in the booking widget's frontend JavaScript, and a PUT request with a urlencoded body bypasses the plugin's blocklist by preventing PHP from populating the relevant superglobals. No public exploit identified at time of analysis, though Wordfence has documented the technique in detail.
Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (versions up to 1.6.10.0) through the 'fields' parameter to extract sensitive database information including usernames, email addresses, and password hashes. The vulnerability stems from insufficient input escaping and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.
High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method ...
Incorrect authorization in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.11) allows unauthenticated attackers who possess a valid per-appointment booking token to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. The weakness is a business-logic authorization flaw (CWE-863) confined to appointment records: it grants no server access, no data disclosure, and no code execution, which is why it carries a moderate CVSS score of 5.3 (integrity-only, low impact). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though sites that rely on the plugin's payment-confirmation or service-assignment fields (for example, paid bookings) face the greatest practical exposure.
Authenticated WordPress users at subscriber level or above can exploit an insecure direct object reference in the Simply Schedule Appointments plugin (all versions up to and including 1.6.12.31) through the 'complete_group' parameter to harvest every co-booker's private per-appointment id_token (surfaced as public_token) along with their name and email address, then reuse each leaked token to read, overwrite arbitrary appointment metadata, or cancel the victim's booking via the same REST controller. Exploitation is access-gated rather than open to anonymous scans: the attacker must already hold a valid id_token for at least one appointment inside the targeted group booking, and the exposure is confined to co-bookers of that shared booking, so real-world risk scales with how heavily a site relies on group bookings. No public exploit code and no CISA KEV listing were identified at time of analysis, though an independent assessment rates integrity and availability impact higher than the vendor vector (CVSS 3.1 C:H/I:H/A:L versus the published C:H/I:N/A:N), reflecting the token-reuse tampering path.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Missing authorization on the bulk appointments REST API endpoint in Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.8) permits unauthenticated mass modification and disclosure of customer appointment data. The flaw is compounded by a static, user-independent nonce embedded in the HTML source of any page rendering the [ssa_booking] shortcode, meaning a single anonymous page visit yields a credential sufficient to target every appointment in the system. An attacker can overwrite customer PII, alter payment status, and hijack meeting URLs across all bookings, or enumerate full customer records via the bulk endpoint response - no account or session required. No public exploit code and no CISA KEV listing are identified at time of analysis.
Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delete, and modify arbitrary appointments due to missing authorization checks in REST API endpoints. The plugin exposes a site-wide public nonce through an unauthenticated endpoint (/wp-json/ssa/v1/embed-inner), and the appointment deletion and modification endpoints (/wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk) accept requests with this public nonce even when standard WordPress nonce validation fails, bypassing authorization entirely. Attackers can enumerate and delete appointment records, disclose sensitive booking data, and disrupt services without any authentication.
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress versions up to 1.6.9.29, allowing authenticated users with the ssa_manage_appointments capability to access appointment records belonging to other staff members without authorization. Attackers can exploit the get_item_permissions_check method to enumerate and view sensitive customer personally identifiable information by manipulating appointment ID parameters. The vulnerability has a CVSS score of 4.3 with low attack complexity and requires only low-level authentication, making it a practical concern for multi-staff WordPress installations.
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11.8) allows unauthenticated remote attackers to extract sensitive database contents through the 'append_where_sql' parameter on the /appointments/bulk REST endpoint. The endpoint's permission check accepts a public nonce embedded in the booking widget's frontend JavaScript, and a PUT request with a urlencoded body bypasses the plugin's blocklist by preventing PHP from populating the relevant superglobals. No public exploit identified at time of analysis, though Wordfence has documented the technique in detail.
Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (versions up to 1.6.10.0) through the 'fields' parameter to extract sensitive database information including usernames, email addresses, and password hashes. The vulnerability stems from insufficient input escaping and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.
High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method ...
Incorrect authorization in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.11) allows unauthenticated attackers who possess a valid per-appointment booking token to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. The weakness is a business-logic authorization flaw (CWE-863) confined to appointment records: it grants no server access, no data disclosure, and no code execution, which is why it carries a moderate CVSS score of 5.3 (integrity-only, low impact). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though sites that rely on the plugin's payment-confirmation or service-assignment fields (for example, paid bookings) face the greatest practical exposure.
Authenticated WordPress users at subscriber level or above can exploit an insecure direct object reference in the Simply Schedule Appointments plugin (all versions up to and including 1.6.12.31) through the 'complete_group' parameter to harvest every co-booker's private per-appointment id_token (surfaced as public_token) along with their name and email address, then reuse each leaked token to read, overwrite arbitrary appointment metadata, or cancel the victim's booking via the same REST controller. Exploitation is access-gated rather than open to anonymous scans: the attacker must already hold a valid id_token for at least one appointment inside the targeted group booking, and the exposure is confined to co-bookers of that shared booking, so real-world risk scales with how heavily a site relies on group bookings. No public exploit code and no CISA KEV listing were identified at time of analysis, though an independent assessment rates integrity and availability impact higher than the vendor vector (CVSS 3.1 C:H/I:H/A:L versus the published C:H/I:N/A:N), reflecting the token-reuse tampering path.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Missing authorization on the bulk appointments REST API endpoint in Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.8) permits unauthenticated mass modification and disclosure of customer appointment data. The flaw is compounded by a static, user-independent nonce embedded in the HTML source of any page rendering the [ssa_booking] shortcode, meaning a single anonymous page visit yields a credential sufficient to target every appointment in the system. An attacker can overwrite customer PII, alter payment status, and hijack meeting URLs across all bookings, or enumerate full customer records via the bulk endpoint response - no account or session required. No public exploit code and no CISA KEV listing are identified at time of analysis.
Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delete, and modify arbitrary appointments due to missing authorization checks in REST API endpoints. The plugin exposes a site-wide public nonce through an unauthenticated endpoint (/wp-json/ssa/v1/embed-inner), and the appointment deletion and modification endpoints (/wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk) accept requests with this public nonce even when standard WordPress nonce validation fails, bypassing authorization entirely. Attackers can enumerate and delete appointment records, disclose sensitive booking data, and disrupt services without any authentication.
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress versions up to 1.6.9.29, allowing authenticated users with the ssa_manage_appointments capability to access appointment records belonging to other staff members without authorization. Attackers can exploit the get_item_permissions_check method to enumerate and view sensitive customer personally identifiable information by manipulating appointment ID parameters. The vulnerability has a CVSS score of 4.3 with low attack complexity and requires only low-level authentication, making it a practical concern for multi-staff WordPress installations.