CVE-2022-2373: Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-29 · updated 2026-06-17
Weakness: CWE-862

Description

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address

Affected products

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: before 1.5.7.7 — fixed in 1.5.7.7

How to fix

Upgrade to a fixed version: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin 1.5.7.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/6aa9aa0d-b447-4584-a07e-b8a0d1b83a31
https://wpscan.com/vulnerability/6aa9aa0d-b447-4584-a07e-b8a0d1b83a31

Get alerted when CVE-2022-2373 or the next vulnerability affects your stack