CVE-2026-7797

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin versions prior to 1.6.11.9

Description An issue exists where unauthenticated attackers can perform time-based blind SQL Injection, a technique used to extract information from a database by observing the time it takes for the server to respond to specific queries. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. Attackers can append malicious SQL queries to existing ones to extract sensitive data via the /appointments/bulk API endpoint. The endpoint is accessible because the permission check accepts a public nonce (a unique token used to prevent replay attacks) found in the frontend JavaScript ssa.api.public nonce. Exploitation requires a PUT request with an application/x-www-form-urlencoded body to bypass blocklist checks by preventing the population of PHP superglobals. The vulnerable parameter is append where sql.

Recommendations Update to a version newer than 1.6.11.8. Avoid using the append where sql parameter in the /appointments/bulk endpoint until the update is applied.