CVE-2025-12166

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin for WordPress versions prior to 1.6.9.9

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to a blind SQL injection issue. This is due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Specifically, the order and append where sql parameters are vulnerable. This allows unauthenticated attackers to append additional SQL queries to existing queries, potentially extracting sensitive information from the database.

Recommendations Update to a version newer than 1.6.9.9