Product

Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin

1 brief RSS

CVE-2026-7797: WordPress Simply Schedule Appointments Plugin Time-Based Blind SQL Injection

The Appointment Booking Calendar WordPress plugin is vulnerable to time-based blind SQL Injection (CVE-2026-7797) via the 'append_where_sql' parameter, allowing unauthenticated attackers to extract sensitive information from the database by injecting SQL queries through the /appointments/bulk REST endpoint with a specific request format.

Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin wordpress sqli cve-2026-7797 attack.initial_access

2r 1t 1c 2w ago