CVE-2026-6937: WordPress SSA Plugin Auth Bypass Flaw

CVE-2026-6937 Overview

CVE-2026-6937 is a missing authorization vulnerability in the Simply Schedule Appointments booking plugin for WordPress. The flaw affects all plugin versions up to and including 1.6.11.8. The bulk appointments REST API endpoint fails to verify that the requesting user is authorized to perform the requested action. Unauthenticated attackers can modify arbitrary appointment records, including customer personally identifiable information (PII), payment status, and meeting URL fields. The same endpoint also returns full customer PII in its response, enabling data exposure across the entire appointment dataset.

Critical Impact
Unauthenticated attackers can read and modify any appointment record on a vulnerable site, exposing customer PII and tampering with payment status or meeting URLs.

Affected Products

Simply Schedule Appointments plugin for WordPress, versions up to and including 1.6.11.8
WordPress sites hosting the [ssa_booking] shortcode on public pages
Any deployment relying on the plugin's bulk appointments REST API endpoint

Discovery Timeline

2026-05-28 - CVE-2026-6937 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-6937

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness [CWE-862] in the plugin's bulk appointments REST API endpoint. The endpoint accepts requests without verifying that the caller has the rights to read or modify the appointment records being referenced. Because the endpoint operates on appointment objects by identifier, an attacker can target any record stored by the plugin. Successful requests return the affected records in full, including customer PII fields. Modifications persist to the database, so changes to payment status or meeting URLs survive future legitimate sessions.

Root Cause

The root cause is an authorization check that is absent from the bulk endpoint's permission_callback logic. The plugin relies on a public nonce as its only gating mechanism, but that nonce is static and user-independent. The nonce is rendered into the HTML source of every page that hosts the [ssa_booking] shortcode. Any unauthenticated visitor that loads such a page receives a nonce sufficient to authorize bulk appointment operations.

Attack Vector

An attacker first requests any public page on the target site that renders the [ssa_booking] shortcode. The attacker extracts the static nonce from the returned HTML. The attacker then issues REST API requests to the bulk appointments endpoint with the harvested nonce. Requests can enumerate, read, and modify arbitrary appointment IDs without authentication. Targets include customer names, email addresses, phone numbers, payment status flags, and meeting URLs. No user interaction on the victim site is required for exploitation.

No verified proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details.

Detection Methods for CVE-2026-6937

Indicators of Compromise

Unauthenticated requests to REST routes registered under the plugin's bulk appointments endpoint, particularly to paths derived from class-td-api-model.php.
Outbound HTTP responses containing appointment records to clients without authenticated session cookies.
Unexpected modifications to appointment payment_status or meeting URL fields not tied to an administrative session.
Repeated REST requests carrying the same static nonce value across many distinct source IP addresses.

Detection Strategies

Inspect web access logs for POST, PUT, or DELETE requests to /wp-json/ssa/v1/ routes from clients lacking a wordpress_logged_in_ cookie.
Compare appointment record change timestamps against the WordPress users table to identify writes with no corresponding logged-in administrator.
Alert on bulk REST responses larger than a baseline size, which can indicate enumeration of the appointment dataset.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized log platform for retroactive hunting.
Track REST endpoint request volumes per source IP and flag spikes against the ssa namespace.
Audit the appointments database table on a recurring schedule and diff changes against expected administrator activity.

How to Mitigate CVE-2026-6937

Immediate Actions Required

Update the Simply Schedule Appointments plugin to a version newer than 1.6.11.8 once the vendor publishes a fixed release.
Remove the [ssa_booking] shortcode from public pages until the plugin is patched to limit static nonce exposure.
Review appointment records for unauthorized modifications to PII, payment status, and meeting URL fields.
Notify affected customers if PII exposure is confirmed, in line with applicable breach notification requirements.

Patch Information

The vulnerability is documented as affecting all versions up to and including 1.6.11.8. Site administrators should monitor the Wordfence Vulnerability Report and the official plugin listing for the fixed release version, then apply the update through the WordPress plugin manager.

Workarounds

Restrict access to /wp-json/ssa/ REST routes at the web application firewall (WAF) or reverse proxy, allowing only authenticated administrator IP ranges.
Temporarily deactivate the Simply Schedule Appointments plugin if booking functionality is not business-critical.
Rotate any sensitive meeting URLs that were stored in appointment records prior to remediation.

bash

# Example NGINX rule to restrict the plugin's REST namespace to allowlisted IPs
location ~ ^/wp-json/ssa/ {
    allow 203.0.113.0/24;   # admin office range
    deny all;
    try_files $uri $uri/ /index.php?$args;
}