CVE Explorer
CVE-2026-3045
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method in `SSA_Settings_Api` relies on `nonce_permissions_check()` for authorization (which accepts the public
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin","vendor":"croixhaug","versions":[{"lessThanOrEqual":"1.6.9.29","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-bootstrap.php#L151"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-settings-api.php#L128"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/lib/td-util/class-td-api-model.php#L361"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480506%40simply-schedule-appointments%2Ftrunk&old=3475885%40simply-schedule-appointments%2Ftrunk&sfp_email=&sfph_mail=#file0"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/references/4
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5970b8d6-0041-4c30-a6ce-fe67ebf415f5?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6611cd4073e42388a04f2fa706a869eecac6a7f91ae5bb7cf9bfce8b50dba8a2 · sha256:8993c8f561aa432c… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.