This vulnerability (CVE-2026-39493) involves improper neutralization of special elements used in SQL commands (CWE-89) in the Simply Schedule Appointments plugin by NSquared. It affects versions up to 1.6.9.27 and allows unauthenticated attackers to perform SQL Injection attacks. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to sensitive data due to SQL Injection, compromising confidentiality. The vulnerability does not directly impact integrity but may cause limited availability issues. The attack requires no authentication and can be performed remotely, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application where possible and monitor for unusual activity related to database queries. Avoid exposing the vulnerable version to untrusted networks.