CVE-2026-7797 is a high-severity SQL Injection vulnerability (CWE-89) affecting the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress up to version 1.6.11.8. The flaw arises from insufficient escaping of the 'append_where_sql' parameter and inadequate preparation of the SQL query, allowing unauthenticated attackers to inject additional SQL commands. The /appointments/bulk REST endpoint is vulnerable because it accepts a public nonce visible in frontend JavaScript, enabling attackers to bypass permission checks by sending a PUT request with a specific content type that avoids PHP superglobal population and blocklist detection. This vulnerability can be exploited to extract sensitive data from the database.

An unauthenticated attacker can exploit this vulnerability to perform time-based blind SQL Injection attacks, potentially extracting sensitive information from the backend database. The vulnerability does not allow modification or deletion of data (no integrity or availability impact indicated), but the confidentiality of the database is at risk. The attack vector is network accessible without privileges or user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider restricting access to the /appointments/bulk REST endpoint or disabling the plugin if feasible. Monitor vendor channels for updates and apply official patches promptly once released.