# CVE-2026-39694: NSquared Simply Schedule Appointments missing authorization

Source: https://junglewise.ai/threats/cve-2026-39694-nsquared-simply-schedule-appointments-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39694 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Simply Schedule Appointments is a WordPress plugin used by businesses to manage online bookings and scheduling. A security flaw in the plugin's access control settings allows unauthorized individuals to bypass intended security levels. This could potentially allow an attacker to modify scheduling configurations or perform actions that should be restricted to administrators, impacting the integrity of the booking system.

## Quick answers

**Is CVE-2026-39694 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39694 being exploited in the wild.

**How severe is CVE-2026-39694?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** NSquared Simply Schedule Appointments <= 1.6.10.2 (and up to 1.6.11.0 per some sources).

**Is there a fix for CVE-2026-39694?** A patch was published on 2026-02-26: Patch released in version 1.6.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39694 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39694?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization (CWE-862) vulnerability exists in the NSquared Simply Schedule Appointments plugin for WordPress. The flaw stems from a failure to properly validate user permissions or security levels within the plugin's access control logic. An unauthenticated remote attacker can exploit this to perform actions or access functionality that should be restricted to higher-privileged users. The vulnerability is present in versions up to and including 1.6.10.2 (with some reports indicating up to 1.6.11.0). Users are advised to update to version 1.6.11.1 or later to remediate the issue.

## Affected products

- NSquared Simply Schedule Appointments <= 1.6.10.2 (and up to 1.6.11.0 per some sources)

## Timeline

- 2026-01-27: other: Reported by researcher hhhai
- 2026-02-26: disclosed: Initial disclosure by Patchstack
- 2026-02-26: patched: Patch released in version 1.6.11.1
- 2026-04-08: advisory: CVE published

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-10-2-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-10-2-broken-access-control-vulnerability?_s_id=cve)