PT-2025-52418 · WordPress · Simply Schedule Appointments Booking Plugin

Marcin Dudek · Publicado 2025-12-19 · Atualizado 2025-12-19 · CVE-2025-13754

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.9.16

Description The plugin exposes its admin embed endpoint at /wp-json/ssa/v1/embed-inner-admin without authentication. This exposure leaks plugin settings, including staff names, business names, and configuration data not publicly displayed on the booking form. Unauthenticated attackers can extract private business configuration. In premium versions with integrations configured, this may also expose sensitive data including API keys for external services.

Recommendations Update to a version later than 1.6.9.16.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-13754

Produtos afetados

Simply Schedule Appointments Booking Plugin

Referências · 6

• https://t.me/CVEtracker/40241 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2002099186154811901 · Publicação no Twitter
• https://t.me/cveNotify/146297 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13754 · Nota de Segurança