croixhaug Appointment Booking Calendar Plugin up to 1.6.11.8 on WordPress REST API Endpoint authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in croixhaug Appointment Booking Calendar Plugin up to 1.6.11.8 on WordPress. This affects an unknown part of the component REST API Endpoint. The manipulation leads to authorization. This vulnerability is documented as CVE-2026-6937. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in croixhaug Appointment Booking Calendar Plugin up to 1.6.11.8 on WordPress. It has been rated as critical. This issue affects an unknown functionality of the component REST API Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.11.8 due to the plugin not properly verifying that a user is authorized to perform an action via the bulk appointments REST API endpoint. This makes it possible for unauthenticated attackers to modify arbitrary appointment records including customer PII, payment status, and meeting URL fields, and to expose full customer PII from existing appointment records via the bulk endpoint response. The public nonce is a static, user-independent value present in the HTML source of any page hosting the [ssa_booking] shortcode, meaning any visitor who has viewed such a page can obtain it and target any appointment in the system without authentication.

The weakness was released by winrace. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-6937 since 04/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.6.10.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Appointment Software

Vendor

• croixhaug

Name

• Appointment Booking Calendar Plugin

Version

• 1.6.11.0
• 1.6.11.1
• 1.6.11.2
• 1.6.11.3
• 1.6.11.4
• 1.6.11.5
• 1.6.11.6
• 1.6.11.7
• 1.6.11.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion