Unauthorized Access Vulnerability in Appointment Booking Calendar by Simply Schedule Appointments

CVE-2026-3045

What is CVE-2026-3045?

The Appointment Booking Calendar by Simply Schedule Appointments for WordPress is susceptible to unauthorized access, compromising sensitive data across all versions up to and including 1.6.9.29. This vulnerability arises from two primary issues: Firstly, a non-user-bound public_nonce is exposed via the public REST endpoint /wp-json/ssa/v1/embed-inner, accessible to unauthenticated users. Secondly, the get_item() method in SSA_Settings_Api performs an authorization check that incorrectly validates requests using this public nonce without adequately filtering unauthorized settings. Consequently, attackers can retrieve admin-only plugin settings, including sensitive information such as administrator emails and access tokens, while also being able to modify or cancel appointments through the endpoint /wp-json/ssa/v1/settings/{section}.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References