CVE Database /
CVE-2026-39493
CVE · Critical
CVE-2026-39493 — Simply Schedule Appointments [simply-schedule-appointments] < 1.6.9.29
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-39493
|
Simply Schedule Appointments [simply-schedule-appointments] < 1.6.9.29 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.3
|
< 1.6.9.29
|
1.6.9.29 |
2026-04-08 |
—
|
CVE-2026-39493
The Simply Schedule Appointments Booking Plugin for WordPress has a security flaw in versions 1.6.9.27 and earlier, allowing malicious users to inject unauthorized SQL code by exploiting an unescaped parameter in the plugin's SQL queries. This vulnerability enables attackers to add extra SQL commands that can be used to extract sensitive database information without needing authentication.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings