CVE-2026-84764: Simply Schedule Appointments CSRF Vulnerability

CVE-2026-84764 Overview

CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the Simply Schedule Appointments WordPress plugin in versions up to and including 1.6.12.23. The flaw is classified under CWE-352 and allows an attacker to trick an authenticated site administrator into submitting attacker-crafted requests to the plugin. Successful exploitation compromises the confidentiality, integrity, and availability of the affected WordPress instance. The attack requires user interaction, typically by luring a logged-in administrator to visit a malicious page.

Critical Impact

An attacker can hijack administrator sessions through crafted CSRF payloads, leading to state-changing actions on the WordPress site without the administrator's consent.

Affected Products

• Simply Schedule Appointments WordPress plugin versions <= 1.6.12.23
• WordPress sites with the plugin installed and active
• Administrators authenticated to vulnerable installations

Discovery Timeline

• 2026-09-02 - CVE-2026-84764 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84764

Vulnerability Analysis

The vulnerability stems from missing anti-CSRF token validation on state-changing endpoints exposed by the Simply Schedule Appointments plugin. WordPress provides nonce mechanisms via wp_nonce_field() and check_admin_referer(), but the affected plugin endpoints do not enforce nonce verification on sensitive actions. An attacker exploits this gap by hosting a malicious page containing an auto-submitting form or embedded request targeting the plugin's action handler. When a logged-in WordPress administrator visits the attacker-controlled page, the browser automatically attaches valid session cookies and issues the request against the target site. The plugin processes the request as if it were initiated by the administrator.

Root Cause

The root cause is improper implementation of request origin validation on privileged plugin actions in Simply Schedule Appointments <= 1.6.12.23. The endpoints lack cryptographic nonce checks and do not validate the Origin or Referer headers, so forged cross-origin requests are indistinguishable from legitimate administrator actions.

Attack Vector

Exploitation requires an unauthenticated attacker to prepare a malicious HTML page containing a form or fetch request targeting a vulnerable endpoint. The attacker then delivers the URL to a WordPress administrator through phishing, social media, or a compromised third-party site. Upon page load in the administrator's browser, the request is sent with authenticated cookies. See the Patchstack CSRF Vulnerability Report for technical details.

Detection Methods for CVE-2026-84764

Indicators of Compromise

• Administrator-initiated state changes in Simply Schedule Appointments settings that correlate with Referer headers pointing to external domains.
• Unexpected modifications to appointment configurations, integrations, or notification endpoints without corresponding admin session activity in audit logs.
• HTTP POST requests to plugin endpoints with missing or invalid _wpnonce parameters.

Detection Strategies

• Monitor WordPress access logs for POST requests to Simply Schedule Appointments handlers originating from cross-site Referer values.
• Correlate administrator authentication events with subsequent plugin configuration changes to identify anomalous action sequences.
• Deploy a Web Application Firewall (WAF) rule that inspects requests to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php for the plugin's action names and flags missing nonce parameters.

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture setting changes, user creation, and plugin configuration events with source IP and referer metadata.
• Alert on administrator sessions where sensitive actions occur within seconds of the account visiting an external URL.
• Aggregate WordPress logs into a centralized SIEM for correlation of CSRF-indicative patterns across multiple sites.

How to Mitigate CVE-2026-84764

Immediate Actions Required

• Update Simply Schedule Appointments to a version later than 1.6.12.23 as soon as the vendor releases a fixed release.
• Instruct WordPress administrators to log out of the admin console when not actively performing management tasks.
• Restrict access to /wp-admin/ by IP allowlist or VPN where feasible to reduce CSRF exposure.

Patch Information

Refer to the Patchstack CSRF Vulnerability Report for vendor patch status and remediation guidance. Apply the patched plugin version through the WordPress plugin manager once available.

Workarounds

• Deploy a WAF rule that blocks POST requests to plugin endpoints lacking a valid same-origin Referer header.
• Use a browser profile dedicated to WordPress administration and avoid visiting untrusted sites in that profile.
• Temporarily deactivate the Simply Schedule Appointments plugin if the site does not require its functionality until a patch is applied.

# Example WAF rule (ModSecurity) to enforce same-origin on admin-ajax.php
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,phase:2,deny,status:403,id:1026084764,msg:'CSRF: cross-origin admin-ajax POST'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"