CVE-2026-3658 is an SQL Injection vulnerability (CWE-89) affecting the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, specifically via the 'fields' parameter. The plugin versions up to and including 1.6.10.0 do not properly escape user-supplied input nor sufficiently prepare SQL queries, enabling unauthenticated attackers to append malicious SQL commands. This can be exploited to extract sensitive information from the database, including usernames, email addresses, and password hashes. The vulnerability is remotely exploitable without authentication and requires low attack complexity. The CVSS 3.1 base score is 7.5 (High). No official patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the plugin's database, including usernames, email addresses, and password hashes. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability is remotely exploitable without authentication, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or trusted security sources is recommended.