CVE-2026-1708: WordPress Booking Plugin SQLi Vulnerability

CVE-2026-1708 Overview

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress contains a blind SQL injection vulnerability in all versions up to and including 1.6.9.27. The vulnerability exists due to the db_where_conditions method in the TD_DB_Model class failing to properly validate the append_where_sql parameter when received through JSON request bodies. While the code checks for this parameter in the $_REQUEST superglobal, it does not prevent the same parameter from being passed via JSON payloads, creating an exploitable input validation gap.

This flaw allows unauthenticated attackers to append arbitrary SQL commands to database queries and extract sensitive information, provided they have obtained a valid public_token that is inadvertently exposed during the normal booking flow.

Critical Impact

Unauthenticated attackers can exploit this blind SQL injection vulnerability to extract sensitive database contents including user credentials, personal information, and other confidential data stored in WordPress databases.

Affected Products

• Simply Schedule Appointments Booking Plugin for WordPress versions up to and including 1.6.9.27
• WordPress sites using vulnerable versions of the Simply Schedule Appointments plugin

Discovery Timeline

• 2026-03-11 - CVE-2026-1708 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-1708

Vulnerability Analysis

This blind SQL injection vulnerability stems from an input validation inconsistency in how the plugin handles the append_where_sql parameter. The db_where_conditions method in the TD_DB_Model class implements a security check that examines the $_REQUEST superglobal to determine if the dangerous append_where_sql parameter is present. However, this check fails to account for JSON request bodies, which are parsed separately and can bypass the $_REQUEST-based validation entirely.

When an attacker crafts a JSON payload containing the append_where_sql parameter and includes a valid public_token (which is exposed during the legitimate booking workflow), they can inject arbitrary SQL commands that are appended to database queries without proper sanitization. Because this is a blind SQL injection, attackers cannot see query results directly but can infer database contents through time-based or boolean-based extraction techniques.

Root Cause

The root cause is a failure to implement consistent input validation across all input vectors. The security check only validates the $_REQUEST superglobal while the application logic separately processes JSON request bodies. This creates a bypass where the append_where_sql parameter in JSON payloads evades the security check but is still processed by the database query builder. Additionally, the public_token authentication mechanism inadvertently exposes valid tokens during normal booking operations, lowering the barrier for exploitation.

Attack Vector

The attack vector is network-based and can be exploited by unauthenticated remote attackers. The attack flow involves:

1. An attacker observes the booking flow to capture a valid public_token exposed during normal plugin operations
2. The attacker crafts a malicious JSON request containing the append_where_sql parameter with SQL injection payload
3. The request bypasses the $_REQUEST-based security check since the parameter is in the JSON body
4. The injected SQL commands are appended to legitimate database queries
5. Through blind SQL injection techniques (time-based or boolean-based), the attacker extracts sensitive database information

The vulnerability is exploited by sending specially crafted JSON POST requests to WordPress REST API endpoints used by the plugin. The blind nature of the injection requires attackers to use inference-based techniques such as SLEEP() functions or conditional statements to extract data character by character.

Detection Methods for CVE-2026-1708

Indicators of Compromise

• Unusual JSON POST requests to Simply Schedule Appointments plugin endpoints containing append_where_sql parameters
• Database query logs showing unexpected SLEEP(), BENCHMARK(), or WAITFOR DELAY SQL commands
• Anomalous response times on appointment-related API endpoints indicating time-based SQL injection attempts
• Web server logs showing repeated requests with varying public_token values from single IP addresses

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in JSON request bodies
• Monitor WordPress REST API access logs for suspicious patterns targeting /wp-json/ endpoints related to the Simply Schedule Appointments plugin
• Configure database query logging to identify queries containing injection indicators such as UNION SELECT, SLEEP(), or comment sequences (--, /**/)
• Deploy SentinelOne Singularity platform to detect anomalous process behavior and suspicious database access patterns

Monitoring Recommendations

• Enable verbose logging on WordPress installations and review logs for unusual appointment-related API activity
• Set up alerting for abnormally slow database query response times which may indicate time-based SQL injection exploitation
• Monitor for bulk data exfiltration attempts that could indicate successful database extraction
• Track authentication token usage patterns to identify potential token harvesting activity

How to Mitigate CVE-2026-1708

Immediate Actions Required

• Update Simply Schedule Appointments Booking Plugin to version 1.6.9.28 or later immediately
• Review WordPress database for signs of unauthorized access or data extraction
• Audit web server logs for indicators of exploitation attempts
• Consider temporarily disabling the plugin if immediate patching is not possible

Patch Information

The vulnerability has been addressed in the plugin codebase. The fix is documented in WordPress Changeset 3475885 which modifies the TD_DB_Model class to properly validate the append_where_sql parameter across all input vectors including JSON request bodies. Site administrators should update to the patched version through the WordPress plugin update mechanism. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement a Web Application Firewall rule to block requests containing append_where_sql in JSON payloads targeting the plugin endpoints
• Restrict access to the WordPress REST API using authentication requirements or IP whitelisting where feasible
• Monitor and rotate public_token values if the plugin provides this capability
• Consider using database user permissions to limit the web application's database access to only necessary operations

# Example WAF rule for ModSecurity to block SQL injection attempts in JSON bodies
SecRule REQUEST_BODY "@rx append_where_sql" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'Potential SQL injection attempt via append_where_sql parameter',\
    tag:'CVE-2026-1708'"