# CVE-2026-59523: NSquared Simply Schedule Appointments missing authorization

Source: https://junglewise.ai/threats/cve-2026-59523-nsquared-simply-schedule-appointments-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-59523 · Severity: medium · CVSS 6.5 · Published 2026-07-13

Simply Schedule Appointments is a WordPress plugin used by businesses to manage online bookings and appointments. A security flaw in the plugin allows unauthorized individuals to bypass intended access controls due to missing authorization checks. This could allow an attacker to perform actions or access information that should be restricted to administrators, potentially disrupting scheduling operations or exposing appointment data.

## Quick answers

**Is CVE-2026-59523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59523 being exploited in the wild.

**How severe is CVE-2026-59523?** Medium severity, with a CVSS score of 6.5, published 13 July 2026.

**Which products and versions are affected?** NSquared Simply Schedule Appointments <= 1.6.11.11.

**Is there a fix for CVE-2026-59523?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59523 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59523?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the Simply Schedule Appointments plugin. It stems from a failure to properly validate user permissions or security levels before executing certain functions, leading to broken access control. An unauthenticated remote attacker can exploit this flaw to perform actions that should require higher privileges. The issue affects all versions up to and including 1.6.11.11 and is resolved in version 1.6.12.0.

## Affected products

- NSquared Simply Schedule Appointments <= 1.6.11.11

## Timeline

- 2026-05-07: disclosed: Reported by anhcd05 to Patchstack
- 2026-07-09: advisory: Patchstack published the vulnerability details
- 2026-07-13: advisory: CVE published in the NVD dataset

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-11-11-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-11-11-broken-access-control-vulnerability?_s_id=cve)