CVE-2026-6723 in Simply Schedule Appointments Plugin
Summary
by MITRE • 10/10/2026
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in the Appointment Booking Calendar plugin, specifically within versions up to 1.6.11.11 of the Simply Schedule Appointments Booking Plugin for WordPress, represents a critical failure in access control mechanisms known as Incorrect Authorization or Broken Access Control. This flaw stems from an insufficient validation process on the REST API endpoint responsible for updating appointment details. While the plugin implements token-based authentication to secure certain administrative functions, it fails to enforce strict field-level restrictions based on the authenticated user's role and permissions. Consequently, any client possessing a valid authorization token can manipulate data fields that are intended to be restricted to administrators only. This architectural oversight allows attackers who have obtained or forged tokens to bypass standard security boundaries designed to protect sensitive operational data within the booking system.
From a technical perspective, the core issue lies in the lack of server-side validation for input parameters during appointment updates. When an API request is received to modify an existing appointment, the backend logic does not adequately verify whether the requesting user has the requisite privileges to alter specific attributes such as payment status, service type, or assigned staff member. This absence of granular permission checks means that fields like paid_status, which should only be updated by internal systems after a verified transaction, can be arbitrarily changed by external actors. Similarly, the ability to reassign appointments allows an attacker to redirect bookings intended for one user to another, disrupting service delivery and potentially causing financial loss or customer dissatisfaction. The modification of service types further exacerbates this risk by allowing attackers to downgrade expensive services to cheaper alternatives or alter the nature of the booked appointment entirely without authorization.
The operational impact of this vulnerability is significant, affecting both business integrity and end-user trust. By faking payment confirmation, an attacker can secure appointments without paying for them, leading directly to revenue loss for the service provider. This manipulation undermines the financial reliability of the booking platform and complicates accounting processes. Furthermore, reassigning appointments disrupts scheduling workflows, potentially causing conflicts with staff availability and customer expectations. If attackers change the service type, it may result in customers receiving services they did not pay for or being charged incorrectly, leading to disputes and reputational damage. In a broader security context, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, highlighting fundamental flaws in how user roles and permissions are enforced within the application logic.
This type of attack is consistent with techniques observed in the MITRE ATT&CK framework under T1078 Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access or perform actions beyond their intended scope. It also relates to T1496 Endpoint Denial of Service if the manipulation causes significant operational disruption, though the primary concern here is data integrity and financial fraud rather than availability denial. The vulnerability underscores the importance of implementing strict object-level permissions in REST APIs, ensuring that each field update request is validated against the user's role before being processed by the database.
To mitigate this risk, immediate action should be taken to upgrade the plugin to a version where these authorization checks have been corrected. Administrators must ensure they are running the latest stable release provided by the vendor, as subsequent versions likely include patches for these access control flaws. In addition to upgrading, organizations should implement Web Application Firewalls that can detect and block anomalous API requests attempting to modify sensitive fields like payment status or user assignments from non-administrative tokens. Regular security audits of custom plugins are essential to identify similar logic errors before they can be exploited. Monitoring logs for unusual patterns in appointment modifications, such as rapid changes to paid statuses by single users, can also aid in early detection and response to potential exploitation attempts.