PT-2025-52418 · WordPress · Simply Schedule Appointments Booking Plugin

Marcin Dudek · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-13754

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.9.16

Description The plugin exposes its admin embed endpoint at /wp-json/ssa/v1/embed-inner-admin without authentication. This exposure leaks plugin settings, including staff names, business names, and configuration data not publicly displayed on the booking form. Unauthenticated attackers can extract private business configuration. In premium versions with integrations configured, this may also expose sensitive data including API keys for external services.

Recommendations Update to a version later than 1.6.9.16.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13754

Affected Products

Simply Schedule Appointments Booking Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13754 · Security Note
• https://t.me/CVEtracker/40241 · Telegram Post
• https://twitter.com/CVEnew/status/2002099186154811901 · Twitter Post
• https://t.me/cveNotify/146297 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve · Note