CVE-2026-42384: Simply Schedule Appointments Disclosure

CVE-2026-42384 Overview

CVE-2026-42384 is an unauthenticated sensitive data exposure vulnerability in the Simply Schedule Appointments WordPress plugin in versions prior to 1.6.11.2. The flaw allows remote attackers to retrieve sensitive information from affected installations without providing credentials or user interaction. The issue is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data and is documented in the Patchstack Vulnerability Report.

Critical Impact
Unauthenticated network attackers can read sensitive appointment data exposed by the plugin, leading to confidentiality loss across affected WordPress sites.

Affected Products

Simply Schedule Appointments WordPress plugin versions earlier than 1.6.11.2
WordPress sites using the vulnerable plugin in default configurations
Booking workflows that store customer or scheduling metadata through the plugin

Discovery Timeline

2026-06-15 - CVE-2026-42384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-42384

Vulnerability Analysis

The vulnerability stems from the plugin returning sensitive information to clients that do not hold appropriate authentication or authorization context. An unauthenticated attacker can interact with the plugin over the network and observe data that should be restricted to administrators or appointment owners. The flaw maps to CWE-201, where sensitive information is inserted into responses sent to unauthorized parties. EPSS data on 2026-06-18 reports a probability of 0.294% at the 20.867 percentile, indicating limited but non-zero forecasted exploitation activity.

Root Cause

The Simply Schedule Appointments plugin fails to enforce sufficient access control on endpoints that disclose appointment-related data. Requests reaching these endpoints receive sensitive content without the plugin verifying the caller's identity or role. This missing authorization check converts what should be a privileged read into an anonymous information disclosure path.

Attack Vector

Exploitation requires only network access to the WordPress site running a vulnerable version of the plugin. An attacker issues crafted HTTP requests directly to the plugin's exposed endpoints and parses the responses for sensitive fields. No credentials, social engineering, or user interaction are required, which makes opportunistic scanning across WordPress hosts a realistic delivery method. Technical details are described in the Patchstack Vulnerability Report.

// No verified public exploit code is available for CVE-2026-42384.
// Refer to the Patchstack advisory for technical specifics.

Detection Methods for CVE-2026-42384

Indicators of Compromise

Unauthenticated HTTP GET requests to Simply Schedule Appointments REST endpoints under /wp-json/ssa/ returning appointment or customer fields
Repeated anonymous requests from a single source iterating through appointment identifiers
Web server access logs showing successful 200 responses to plugin endpoints without an authenticated session cookie

Detection Strategies

Inventory all WordPress sites and confirm the installed Simply Schedule Appointments version is 1.6.11.2 or later
Inspect web application firewall and reverse proxy logs for anonymous traffic targeting plugin REST routes
Correlate plugin endpoint access with authentication state to flag requests returning data without a valid session

Monitoring Recommendations

Forward WordPress access logs and PHP error logs into a centralized logging or SIEM platform for retention and search
Alert on bursts of requests to /wp-json/ssa/ paths originating from non-administrative IP ranges
Track plugin version drift across managed WordPress hosts and notify when outdated installations appear

How to Mitigate CVE-2026-42384

Immediate Actions Required

Upgrade Simply Schedule Appointments to version 1.6.11.2 or later on every WordPress instance
Audit recent plugin endpoint traffic for signs of anonymous data scraping prior to patching
Rotate or notify affected appointment data subjects if log review confirms exposure

Patch Information

The vendor addresses CVE-2026-42384 in Simply Schedule Appointments 1.6.11.2. Administrators should apply the update through the WordPress plugin manager or by deploying the fixed release through their configuration management pipeline. Patch metadata and version guidance are available in the Patchstack Vulnerability Report.

Workarounds

Restrict access to plugin REST endpoints at the web server or WAF layer until patching completes
Temporarily deactivate the plugin on sites that cannot be updated immediately
Apply IP allowlisting on /wp-json/ routes used by Simply Schedule Appointments for staff-only booking workflows

bash

# Example NGINX rule to block anonymous access to plugin REST routes pre-patch
location ~ ^/wp-json/ssa/ {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}