CVE-2026-39694
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Missing authorization in the Simply Schedule Appointments plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.6.10.2.
Risk Assessment
An attacker could gain unauthorized access to appointment schedules, potentially leading to patient privacy breaches and operational disruption.
Recommendation
Update the Simply Schedule Appointments plugin to the latest version that includes a fix for the missing authorization.
Original NVD description (English source)
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.