CVE-2026-94074: Unauthenticated Access in Simply Schedule Appointments

CVE-2026-94074 describes an unauthenticated Broken Access Control flaw in the Simply Schedule Appointments WordPress plugin up to version 1.6.12.29. The vulnerability allows unauthenticated attackers to access critical plugin functionality, compromising confidentiality and integrity of data handled by the plugin.

The vulnerability scores CVSS 6.5 with an official medium severity rating. It was registered in the National Vulnerability Database on September 30, 2026. As of November 7, 2026, public repositories on GitHub report containing a Proof-of-Concept for exploitation, a signal that the vulnerability has become known in the security landscape.

WordPress administrators using Simply Schedule Appointments must immediately verify the installed version and update the plugin to a version after 1.6.12.29. Review access logs for signs of recent exploitation. Where feasible, implement Web Application Firewall rules or access controls to limit plugin access until the update is completed.