sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total44
Critical2
High18
Medium24
Reset
Showing 1-20 of 44 records
Threat Entry Updated 2026-10-10

Simply Schedule Appointments - Security Vulnerability (CVE-2026-6723)

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

PLUGIN Simply Schedule Appointments

CVE-2026-6723

MEDIUM CVSS 5.3 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Simply Schedule Appointments - Security Vulnerability (CVE-2026-92245)

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.

PLUGIN Simply Schedule Appointments

CVE-2026-92245

HIGH CVSS 7.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Simply Schedule Appointments - Security Vulnerability (CVE-2026-91109)

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment id_token (exposed as public_token) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker…

PLUGIN Simply Schedule Appointments

CVE-2026-91109

MEDIUM CVSS 6.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

Simply Schedule Appointments - Security Vulnerability (CVE-2026-89294)

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication…

PLUGIN Simply Schedule Appointments

CVE-2026-89294

HIGH CVSS 7.5 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-08-20

Simply Schedule Appointments - Security Vulnerability (CVE-2026-13358)

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer…

PLUGIN Simply Schedule Appointments

CVE-2026-13358

MEDIUM CVSS 6.5 2026-08-16
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Simply Schedule Appointments - Security Vulnerability (CVE-2026-16541)

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

PLUGIN Simply Schedule Appointments

CVE-2026-16541

MEDIUM CVSS 6.5 2026-08-15
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Simply Schedule Appointments - Broken Access Control (CVE-2026-15254)

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.

PLUGIN Simply Schedule Appointments

CVE-2026-15254

MEDIUM CVSS 6.5 2026-08-03
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Simply Schedule Appointments - Security Vulnerability (CVE-2026-16540)

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

PLUGIN Simply Schedule Appointments

CVE-2026-16540

HIGH CVSS 7.5 2026-08-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Simply Schedule Appointments - Broken Access Control (CVE-2026-6937)

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.11.8 due to the plugin not properly verifying that a user is authorized to perform an action via the bulk appointments REST API endpoint. This makes it possible for unauthenticated attackers to modify arbitrary appointment records including customer PII, payment status, and meeting URL fields, and to expose full customer PII from existing appointment records via the bulk endpoint response. The public nonce is a…

PLUGIN Simply Schedule Appointments

CVE-2026-6937

MEDIUM CVSS 5.3 2026-05-28
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.