{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/simply-schedule-appointments--1.6.12.29/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simplyscheduleappointments:simply_schedule_appointments:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-94074"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["simply-schedule-appointments (\u003c= 1.6.12.29)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Simply Schedule Appointments"],"content_html":"\u003cp\u003eCVE-2026-94074 is a broken access control vulnerability in the Simply Schedule Appointments WordPress plugin (versions 1.6.12.29 and earlier). The REST API endpoint \u003ccode\u003e/ssa/v1/appointments\u003c/code\u003e relies on an MD5 HMAC token for authentication. Due to an input validation error, supplying an appointment ID as a float (e.g., '1.9') causes the application to generate a predictable HMAC token. This allows unauthenticated attackers to access, cancel, or delete appointments. The vulnerability was reported by Mor Golan and a proof-of-concept exploit script is publicly available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a site running a vulnerable version of the Simply Schedule Appointments plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a request to the \u003ccode\u003e/ssa/v1/appointments\u003c/code\u003e endpoint using an appointment ID formatted as a float (e.g., \u003ccode\u003e1.9\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe plugin application incorrectly handles the float ID, bypassing the intended token validation logic.\u003c/li\u003e\n\u003cli\u003eAttacker computes the HMAC token offline using the public salt and the manipulated float ID.\u003c/li\u003e\n\u003cli\u003eAttacker sends the request with the forged token to the REST API.\u003c/li\u003e\n\u003cli\u003eThe API returns sensitive customer information, including name, email, phone number, and a valid \u003ccode\u003epublic_token\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker uses the harvested \u003ccode\u003epublic_token\u003c/code\u003e to authenticate subsequent requests to cancel or delete the appointment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated users to perform unauthorized actions, including the exfiltration of personally identifiable information (PII) and the unauthorized deletion of appointment records.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Simply Schedule Appointments plugin to version 1.6.12.31 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit access logs for anomalous requests to the \u003ccode\u003e/ssa/v1/appointments\u003c/code\u003e endpoint, specifically those containing float values or unexpected parameters in the appointment ID query.\u003c/li\u003e\n\u003cli\u003eReview WordPress plugin inventory to ensure no sites are running the identified vulnerable versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T14:08:07Z","date_published":"2026-11-07T14:08:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-94074-ssa/","summary":"A public exploit exists for CVE-2026-94074 in the Simply Schedule Appointments WordPress plugin, allowing unauthenticated attackers to bypass REST API authorization and delete or retrieve sensitive customer appointment data.","title":"Simply Schedule Appointments: Broken access control (CVE-2026-94074)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-94074-ssa/"}],"language":"en","title":"CraftedSignal Threat Feed - Simply-Schedule-Appointments (\u003c= 1.6.12.29)","version":"https://jsonfeed.org/version/1.1"}