What’s Vulnerable › Vulnerabilities

CVE-2026-6723: Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-10 · updated 2026-10-13
• Weakness: CWE-863

Description

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

Affected products

• croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: through 1.6.11.11

References

• https://plugins.trac.wordpress.org/changeset/3562241/simply-schedule-appointments
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f16178-1aa3-4af2-a125-74467bc57e70?source=cve

Get alerted when CVE-2026-6723 or the next vulnerability affects your stack