WordPress simply-schedule-appointments Plugin Unauthenticated SQL Injection (CVE-2026-7797)

Vulnerability Overview Vulnerability Name: Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter CVE ID: CVE-2026-7797 CVSS Score: 7.5 (High) Published Date: May 27, 2026 Last Updated Date: May 28, 2026 Researcher: daroo Affected Range Software Type: Plugin Software Slug: simply-schedule-appointments Affected Versions: <= 1.6.11.8 Fixed Version: 1.6.11.9 Remediation Mitigation: Upgrade to version 1.6.11.9 or later. Vulnerability Description The vulnerability exists in the Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin, specifically involving unauthenticated SQL Injection via the 'append_where_sql' parameter. Attackers can exploit this vulnerability to execute arbitrary SQL queries without restriction, thereby extracting sensitive information from the database. References plugins.trac.wordpress.org Additional Information Share: Provides sharing options for Facebook, Twitter, LinkedIn, and Email. Recent vulnerabilities: Lists other recent vulnerabilities for this plugin, including titles, CVE IDs, CVSS scores, researchers, and dates. Disclaimer This record contains copyrighted material, owned by Defiant Inc. and MITRE Corporation. Contact Us For any errors or to add information, please contact wfi-support@wordfence.com. Business Hours Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-12am UTC/GMT, excluding weekends and holidays. Customer support is available 24/7, with a response time of 1 hour. Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook Instagram YouTube Subscribe Subscribe to news and updates provided by experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Subscribe to news and updates provided by experienced security professionals. Disclaimer This record contains copyrighted material, owned by Defiant Inc. and MITRE Corporation. Contact Us For any errors or to add information, please contact wfi-support@wordfence.com. Business Hours Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-12am UTC/GMT, excluding weekends and holidays. Customer support is available 24/7, with a response time of 1 hour. Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook Instagram YouTube Subscribe Subscribe to news and updates provided by experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Subscribe to news and updates provided by experienced security professionals. Disclaimer This record contains copyrighted material, owned by Defiant Inc. and MITRE Corporation. Contact Us For any errors or to add information, please contact wfi-support@wordfence.com. Business Hours Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-12am UTC/GMT, excluding weekends and holidays. Customer support is available 24/7, with a response time of 1 hour. Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook Instagram YouTube Subscribe Subscribe to news and updates provided by experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Subscribe to news and updates provided by experienced security professionals. Disclaimer This record contains copyrighted material, owned by Defiant Inc. and MITRE Corporation. Contact Us For any errors or to add information, please contact wfi-support@wordfence.com. Business Hours Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-12am UTC/GMT, excluding weekends and holidays. Customer support is available 24/7, with a response time of 1 hour. Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Faceb

Goal Reached Thanks to every supporter — we hit 100%!

WordPress simply-schedule-appointments Plugin Unauthenticated SQL Injection (CVE-2026-7797)

More from this source