PT-2026-26283 · WordPress · Simply Schedule Appointments Booking Plugin

Momopon1415 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-3658

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.10.0

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and query preparation. Specifically, the fields parameter is not properly escaped, allowing attackers to inject additional SQL queries into existing database queries. This could allow unauthenticated attackers to extract sensitive information from the database, including usernames, email addresses, and password hashes.

Recommendations Update Simply Schedule Appointments Booking Plugin to version 1.6.10.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3658

Affected Products

Simply Schedule Appointments Booking Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3658 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/67c7b9b2-e73f-47fe-aecc-14e998a607c8?source=cve · Note
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-db-model.php#L1171 · Note
• https://twitter.com/RedPacketSec/status/2034795490663891071 · Twitter Post
• https://twitter.com/CVEnew/status/2036024215825244621 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3485143 · Note
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-api-model.php#L140 · Note
• https://twitter.com/VulmonFeeds/status/2034654698779627618 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-type-model.php#L907 · Note