Vulnerability · Published Oct 10, 2026 · Assigned by Wordfence
CVE-2026-6723Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
Medium 5.3
In plain English
A medium-severity incorrect authorization in Simply Schedule Appointments from croixhaug. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| croixhaug | Simply Schedule Appointments | 0 – through 1.6.11.11 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N