WordPress security changelog
MEDIUM CVE-2026-4807 Deferred

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: A security weakness

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.6.10.6.

CVE / CNA score 6.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Plugin slug
simply-schedule-appointments
Affected
<= 1.6.10.6
Safe version
See mitigation notes
Published
May 07, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published May 07, 2026 and is one of 38 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified. Update Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin when a release after 1.6.10.6 becomes available; until then, disable and remove it when the site's risk warrants. The official upstream changelog lists version 1.6.12.17, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed authorization logic in the nonce_permissions_check() method combined with the public exposure of a site-wide reusable nonce. The plugin exposes a public_nonce value through the /wp-json/ssa/v1/embed-inner endpoint, which is accessible to unauthenticated users. The appointment deletion endpoint at /wp-json/ssa/v1/appointments/{id}/delete and /wp-json/ssa/v1/appointments/bulk use a permission check that accepts requests containing both an X-WP-Nonce header (with any arbitrary value) and an X-PUBLIC-Nonce header (with the valid public nonce). When the X-WP-Nonce validation fails, the function falls back to validating the X-PUBLIC-Nonce without properly rejecting the request. Since the public_nonce is exposed to all unauthenticated visitors and is site-wide (not user-specific or appointment-specific), attackers can obtain it and use it to view details of arbitrary appointments, including the public_edit_url, or delete arbitrary appointments by ID. This makes it possible for unauthenticated attackers to view, delete or modify any appointment in the system, disclosing sensitive appointment data, causing service disruption, and loss of booking records.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Primary and upstream sources