CVE-2026-6937 Details
Description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.11.8 due to the plugin not properly verifying that a user is authorized to perform an action via the bulk appointments REST API endpoint. This makes it possible for unauthenticated attackers to modify arbitrary appointment records including customer PII, payment status, and meeting URL fields, and to expose full customer PII from existing appointment records via the bulk endpoint response. The public nonce is a static, user-independent value present in the HTML source of any page hosting the [ssa_booking] shortcode, meaning any visitor who has viewed such a page can obtain it and target any appointment in the system without authentication.
A vulnerability exists in the Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin for WordPress, affecting all versions up to and including 1.6.11.8. The issue stems from the plugin's failure to properly verify user authorization for actions performed through the bulk appointments REST API endpoint. This oversight allows unauthenticated attackers to arbitrarily modify appointment records, including sensitive customer information, payment statuses, and meeting URLs. Additionally, the vulnerability enables the extraction of full customer details from existing appointment records via the bulk endpoint response. The public nonce, which is a static, user-independent value, can be easily obtained by any visitor who has viewed a page with the [ssa_booking] shortcode, facilitating unauthorized access to appointment modifications.
Users are advised to update the Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin to version 1.6.11.9 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Simply Schedule Appointments | <= 1.6.11.8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |