ZeroDay Findings
Sign inSign up

Findings

CVE-2026-1708

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and inc…

Published Mar 11, 2026 · updated Jun 17, 2026

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the method in the class failing to prevent the parameter from being passed through JSON request bodies, while only checking for its presence in the superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the parameter in JSON payloads granted they have obtained a valid that is inadvertently exposed during the booking flow.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 11, 2026 · NIST NVD

    Detected

    The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the method in the class failing to prevent the parameter from being passed through JSON request bodies, while only checking for its presence in the superglobal. This makes it possible for unauthentica

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the method in the class failing to prevent the parameter from being passed through JSON request bodies, while only checking for its presence in the superglobal. This makes it possible for unauthentica

Sources

  • CVE.orgVulnerability recordCVE-2026-1708

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-1708

    The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the method in the class failing to prevent t

    nvd.nist.gov

References

CVE-2026-1708 · ZeroDay Findings