Junglewise Threat Intelligence

CVE-2026-6937: Simply Schedule Appointments WordPress plugin missing authorization in REST API

CVE-2026-6937 · Severity: medium · CVSS 5.3 · Published 2026-05-28

Technologies: Simply Schedule Appointments, Simply Schedule Appointments Booking Plugin. Vendors: Simply Schedule Appointments.

Executive brief

The Simply Schedule Appointments plugin for WordPress, which manages online booking and scheduling, contains a security flaw in its appointment management system. An unauthorized person can view or modify appointment details, including customer personal information, payment statuses, and meeting links. This could lead to data privacy breaches and disruption of scheduled services.

Technical details

The vulnerability (CWE-862) exists in the bulk appointments REST API endpoint of the Simply Schedule Appointments plugin due to insufficient authorization checks. The plugin relies on a public nonce that is static and user-independent, which can be extracted from the HTML source of any page using the [ssa_booking] shortcode. An unauthenticated attacker can use this nonce to interact with the REST API to modify appointment fields (such as PII, payment status, and meeting URLs) or retrieve full customer PII from existing records via the endpoint response. The issue affects all versions up to and including 1.6.11.8.

Affected products

  • Simply Schedule Appointments Simply Schedule Appointments Booking Plugin up to, and including, 1.6.11.8

Timeline

  • 2026-05-28: disclosed: Initial publication of the CVE record.
  • 2026-05-28: advisory

References

Related threats