CVE-2025-11723 is a vulnerability in the Simply Schedule Appointments Booking Plugin for WordPress caused by the use of a hardcoded fallback salt in the hash() function. This insufficient randomness (CWE-330) enables unauthenticated attackers to generate valid tokens across sites running affected plugin versions that have not configured a unique salt in wp-config.php. Exploitation allows access to sensitive booking information and the ability to modify bookings. The vulnerability affects all versions up to and including 1.6.9.5. No patch or official fix information is provided in the available data.

An attacker can generate valid authentication tokens without credentials on affected sites that have not set a custom salt, leading to sensitive information exposure and unauthorized modification of booking data. This compromises confidentiality and integrity of appointment bookings but does not affect availability. The CVSS score of 6.5 reflects a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should manually set a unique salt value in the wp-config.php file to prevent use of the hardcoded fallback salt. Monitoring vendor communications for updates or patches is recommended.