Croixhaug
Monthly
Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11.8) allows unauthenticated remote attackers to extract sensitive database contents through the 'append_where_sql' parameter on the /appointments/bulk REST endpoint. The endpoint's permission check accepts a public nonce embedded in the booking widget's frontend JavaScript, and a PUT request with a urlencoded body bypasses the plugin's blocklist by preventing PHP from populating the relevant superglobals. No public exploit identified at time of analysis, though Wordfence has documented the technique in detail.
Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (versions up to 1.6.10.0) through the 'fields' parameter to extract sensitive database information including usernames, email addresses, and password hashes. The vulnerability stems from insufficient input escaping and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.
High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method ...
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Missing authorization on the bulk appointments REST API endpoint in Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.8) permits unauthenticated mass modification and disclosure of customer appointment data. The flaw is compounded by a static, user-independent nonce embedded in the HTML source of any page rendering the [ssa_booking] shortcode, meaning a single anonymous page visit yields a credential sufficient to target every appointment in the system. An attacker can overwrite customer PII, alter payment status, and hijack meeting URLs across all bookings, or enumerate full customer records via the bulk endpoint response - no account or session required. No public exploit code and no CISA KEV listing are identified at time of analysis.
Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delete, and modify arbitrary appointments due to missing authorization checks in REST API endpoints. The plugin exposes a site-wide public nonce through an unauthenticated endpoint (/wp-json/ssa/v1/embed-inner), and the appointment deletion and modification endpoints (/wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk) accept requests with this public nonce even when standard WordPress nonce validation fails, bypassing authorization entirely. Attackers can enumerate and delete appointment records, disclose sensitive booking data, and disrupt services without any authentication.
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress versions up to 1.6.9.29, allowing authenticated users with the ssa_manage_appointments capability to access appointment records belonging to other staff members without authorization. Attackers can exploit the get_item_permissions_check method to enumerate and view sensitive customer personally identifiable information by manipulating appointment ID parameters. The vulnerability has a CVSS score of 4.3 with low attack complexity and requires only low-level authentication, making it a practical concern for multi-staff WordPress installations.
Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11.8) allows unauthenticated remote attackers to extract sensitive database contents through the 'append_where_sql' parameter on the /appointments/bulk REST endpoint. The endpoint's permission check accepts a public nonce embedded in the booking widget's frontend JavaScript, and a PUT request with a urlencoded body bypasses the plugin's blocklist by preventing PHP from populating the relevant superglobals. No public exploit identified at time of analysis, though Wordfence has documented the technique in detail.
Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (versions up to 1.6.10.0) through the 'fields' parameter to extract sensitive database information including usernames, email addresses, and password hashes. The vulnerability stems from insufficient input escaping and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.
High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method ...
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Missing authorization on the bulk appointments REST API endpoint in Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.8) permits unauthenticated mass modification and disclosure of customer appointment data. The flaw is compounded by a static, user-independent nonce embedded in the HTML source of any page rendering the [ssa_booking] shortcode, meaning a single anonymous page visit yields a credential sufficient to target every appointment in the system. An attacker can overwrite customer PII, alter payment status, and hijack meeting URLs across all bookings, or enumerate full customer records via the bulk endpoint response - no account or session required. No public exploit code and no CISA KEV listing are identified at time of analysis.
Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delete, and modify arbitrary appointments due to missing authorization checks in REST API endpoints. The plugin exposes a site-wide public nonce through an unauthenticated endpoint (/wp-json/ssa/v1/embed-inner), and the appointment deletion and modification endpoints (/wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk) accept requests with this public nonce even when standard WordPress nonce validation fails, bypassing authorization entirely. Attackers can enumerate and delete appointment records, disclose sensitive booking data, and disrupt services without any authentication.
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress versions up to 1.6.9.29, allowing authenticated users with the ssa_manage_appointments capability to access appointment records belonging to other staff members without authorization. Attackers can exploit the get_item_permissions_check method to enumerate and view sensitive customer personally identifiable information by manipulating appointment ID parameters. The vulnerability has a CVSS score of 4.3 with low attack complexity and requires only low-level authentication, making it a practical concern for multi-staff WordPress installations.