SQL Injection Vulnerability in Simply Schedule Appointments Plugin for WordPress

CVE-2026-7797

What is CVE-2026-7797?

The Simply Schedule Appointments Booking Plugin for WordPress, in versions up to and including 1.6.11.8, is susceptible to a time-based blind SQL Injection vulnerability. This flaw arises from inadequate escaping of the 'append_where_sql' parameter, allowing unauthenticated attackers to inject malicious SQL queries into existing ones. The vulnerability can be exploited through the /appointments/bulk REST endpoint, which improperly verifies permissions by accepting a public nonce, making it visible in the frontend JavaScript. Attackers can exploit this vulnerability by issuing a specially crafted PUT request, bypassing security checks and potentially gaining access to sensitive database information.

References