PT-2026-33764 · Nsquared · Simply Schedule Appointments

Published 2026-04-20 · Updated 2026-06-15 · CVE-2026-39493

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.9.28

Description An unauthenticated SQL Injection exists in the software, allowing an attacker to execute arbitrary SQL queries without needing to log in. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update to a version newer than 1.6.9.27.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39493

Affected Products

Simply Schedule Appointments

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39493 · Security Note
• https://twitter.com/atomicedgeWAF/status/2046161207434821936 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-9-27-sql-injection-vulnerability-2?_s_id=cve · Note