Missing Authorization in Simply Schedule Appointments Plugin for WordPress

CVE-2026-6937

What is CVE-2026-6937?

The Simply Schedule Appointments Plugin for WordPress suffers from a missing authorization flaw that affects all versions up to and including version 1.6.11.8. This vulnerability results from inadequate verification processes for user permissions when utilizing the bulk appointments REST API endpoint. As a consequence, unauthenticated attackers can manipulate appointment records, compromising sensitive customer information such as personally identifiable information (PII), payment statuses, and meeting URLs. Furthermore, the static public nonce accessible in the HTML source of pages utilizing the [ssa_booking] shortcode allows any visitor to target appointments without authentication, representing a significant security risk.

References