The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all… (CVE-2026-6723)

CVE-2026-6723 describes an incorrect authorization vulnerability in the Simply Schedule Appointments Booking Plugin for WordPress. Specifically, the appointment update REST API endpoint fails to restrict modifications to sensitive fields by token-authenticated customers, enabling unauthorized changes to admin-controlled appointment data. This includes faking payment confirmations, reassigning appointments to other users, and changing service types. The vulnerability affects all plugin versions up to and including 1.6.11.11.

An attacker can modify appointment details without proper authorization, potentially leading to fraudulent payment confirmations, unauthorized reassignment of appointments, and manipulation of service types. This could disrupt appointment management and lead to trust and operational issues for affected sites. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

No patch or official fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restricting access to the REST API endpoints and implementing additional access controls or compensating controls may help reduce risk.