Is CVE-2026-6937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6937 being exploited in the wild.

How severe is CVE-2026-6937?

Medium severity, with a CVSS score of 5.3, published 28 May 2026.

Which products and versions are affected?

Simply Schedule Appointments up to, and including, 1.6.11.8.

Is there a fix for CVE-2026-6937?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6937 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6937?

Check whether you run Simply Schedule Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6937: Simply Schedule Appointments WordPress plugin missing authorization in REST API

CVE-2026-6937 · Severity: medium · CVSS 5.3 · Published 2026-05-28

The Simply Schedule Appointments plugin for WordPress, which manages online booking and scheduling, contains a security flaw in its appointment management system. An unauthorized person can view or modify appointment details, including customer personal information, payment statuses, and meeting links. This could lead to data privacy breaches and disruption of scheduled services.

Technologies: Simply Schedule Appointments. Vendors: Simply Schedule Appointments.

Quick answers

Is CVE-2026-6937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6937 being exploited in the wild.
How severe is CVE-2026-6937?: Medium severity, with a CVSS score of 5.3, published 28 May 2026.
Which products and versions are affected?: Simply Schedule Appointments up to, and including, 1.6.11.8.
Is there a fix for CVE-2026-6937?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6937 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6937?: Check whether you run Simply Schedule Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability (CWE-862) exists in the bulk appointments REST API endpoint of the Simply Schedule Appointments plugin due to insufficient authorization checks. The plugin relies on a public nonce that is static and user-independent, which can be extracted from the HTML source of any page using the [ssa_booking] shortcode. An unauthenticated attacker can use this nonce to interact with the REST API to modify appointment fields (such as PII, payment status, and meeting URLs) or retrieve full customer PII from existing records via the endpoint response. The issue affects all versions up to and including 1.6.11.8.

Affected products

Simply Schedule Appointments Simply Schedule Appointments Booking Plugin up to, and including, 1.6.11.8

Timeline

2026-05-28: disclosed: Initial publication of the CVE record.
2026-05-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.