PT-2026-2964 · WordPress · Simply Schedule Appointments Booking Plugin

Angus Girvan · Published 2026-01-14 · Updated 2026-01-15 · CVE-2025-12166

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.9.9

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to a blind SQL injection issue. This is due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Specifically, the order and append where sql parameters are vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially extracting sensitive information from the database.

Recommendations Update to a version newer than 1.6.9.9

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-12166

Affected Products

Simply Schedule Appointments Booking Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12166 · Security Note
• https://twitter.com/VulmonFeeds/status/2011743828705739203 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5214a399-21a4-4573-9840-1d5043781bc0?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3408539 · Note
• https://twitter.com/CVEnew/status/2011759589721514294 · Twitter Post
• https://twitter.com/RedPacketSec/status/2011600170098581720 · Twitter Post