Unauthenticated Broken Access Control in Simply Schedule Appointments Plugin for WordPress
CVE-2026-94074

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Simply Schedule Appointments
Vendor
CVE Published:
30 September 2026

What is CVE-2026-94074?

The vulnerability affects versions of the Simply Schedule Appointments plugin up to 1.6.12.29, allowing malicious users to exploit an unauthenticated broken access control. This flaw could permit unauthorized access to sensitive functionalities of the plugin, potentially leading to unauthorized actions or data exposure without requiring user authentication. Users are advised to update to the latest version to protect their applications from possible exploitation.

Affected Version(s)

Simply Schedule Appointments <= 1.6.12.29

References

https://patchstack.com/database/wordpress/plugin/simply-s...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mor Golan | Patchstack Bug Bounty Program
.