{"id":"CVE-2026-125437","kind":"vulnerability","aliases":["CVE-2026-125437"],"related":[],"title":"Simply Schedule Appointments WordPress plugin: missing authorization check through 1.6.13.0","description":"Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0.","summary":"Simply Schedule Appointments, a WordPress booking plugin, has a missing authorization check that lets some users reach functions they should not. The sources do not say what data or actions an attacker can get.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","simply-schedule-appointments","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed version of Simply Schedule Appointments in the WordPress admin plugins list; versions through `1.6.13.0` are listed as affected.\n- Confirm whether the plugin is active on the site.","fix":null,"status":"open","published_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:49+00:00","updated_at":"2026-11-11T12:28:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Simply Schedule Appointments WordPress plugin: missing authorization check through 1.6.13.0","impact":"medium","summary":"Simply Schedule Appointments, a WordPress booking plugin, has a missing authorization check that lets some users reach functions they should not. The sources do not say what data or actions an attacker can get.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","simply-schedule-appointments"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions; exact data exposure not stated","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and which actions lack the authorization check.","how_to_check":"- Check the installed version of Simply Schedule Appointments in the WordPress admin plugins list; versions through `1.6.13.0` are listed as affected.\n- Confirm whether the plugin is active on the site.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Simply Schedule Appointments WordPress plugin at version 1.6.13.0 or earlier are listed as affected. The sources do not describe which roles or settings are needed to reach the flaw, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4552,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125437':13A,16A '-2026':12A,15A '1.6.13.0':10A,85C 'access':73C 'action':52B 'affect':78C 'allow':69C 'appoint':3A,21B,25B,64C,68C,81C 'attack':54B 'author':7A,33B,58C 'book':28B 'check':8A,34B 'configur':72C 'control':74C 'cve':11A,14A 'data':50B 'exploit':70C 'function':40B 'get':56B 'incorrect':71C 'issu':77C 'let':36B 'levels.this':76C 'miss':6A,32B,57C 'n/a':83C 'nsquar':61C 'packag':17B 'plugin':5A,29B 'reach':39B 'say':48B 'schedul':2A,20B,24B,63C,67C,80C 'secur':75C 'simpli':1A,19B,23B,62C,66C,79C 'simply-schedule-appoint':18B,65C 'sourc':45B 'user':38B 'vulner':59C 'wordpress':4A,22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Simply Schedule Appointments WordPress plugin at version 1.6.13.0 or earlier are listed as affected. The sources do not describe which roles or settings are needed to reach the flaw, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","simplyscheduleappointments","wordpress"],"campaign_type":null,"search_a":"'-125437':13A,16A '-2026':12A,15A '1.6.13.0':10A 'appoint':3A 'author':7A 'check':8A 'cve':11A,14A 'miss':6A 'plugin':5A 'schedul':2A 'simpli':1A 'wordpress':4A","search_b":"'action':52B 'appoint':21B,25B 'attack':54B 'author':33B 'book':28B 'check':34B 'data':50B 'function':40B 'get':56B 'let':36B 'miss':32B 'packag':17B 'plugin':29B 'reach':39B 'say':48B 'schedul':20B,24B 'simpli':19B,23B 'simply-schedule-appoint':18B 'sourc':45B 'user':38B 'wordpress':22B,27B","search_c":"'1.6.13.0':85C 'access':73C 'affect':78C 'allow':69C 'appoint':64C,68C,81C 'author':58C 'configur':72C 'control':74C 'exploit':70C 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':57C 'n/a':83C 'nsquar':61C 'schedul':63C,67C,80C 'secur':75C 'simpli':62C,66C,79C 'simply-schedule-appoint':65C 'vulner':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125437","severity":null,"published_at":"2026-11-11T12:19:49+00:00","modified_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}