PT-2026-2964 · WordPress · Simply Schedule Appointments Booking Plugin

Angus Girvan · Publicado 2026-01-14 · Atualizado 2026-01-15 · CVE-2025-12166

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.9.9

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to a blind SQL injection issue. This is due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Specifically, the order and append where sql parameters are vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially extracting sensitive information from the database.

Recommendations Update to a version newer than 1.6.9.9

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-12166

Produtos afetados

Simply Schedule Appointments Booking Plugin

Referências · 6

• https://twitter.com/VulmonFeeds/status/2011743828705739203 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/5214a399-21a4-4573-9840-1d5043781bc0?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12166 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3408539 · Nota
• https://twitter.com/CVEnew/status/2011759589721514294 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2011600170098581720 · Publicação no Twitter