CVE-2026-3045

🗓️ 13 Mar 2026 07:23:38Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Unauthenticated access to admin settings and sensitive data via REST endpoints in Appointment Booking Calendar up to version 1.6.9.29.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-3045	13 Mar 202607:23	–	attackerkb
CNNVD	WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments 安全漏洞	13 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-3045 Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint	13 Mar 202607:23	–	cvelist
EUVD	EUVD-2026-11758	13 Mar 202621:31	–	euvd
NVD	CVE-2026-3045	13 Mar 202619:55	–	nvd
Patchstack	WordPress Appointment Booking Calendar plugin <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint vulnerability	13 Mar 202607:09	–	patchstack
Positive Technologies	PT-2026-25154	13 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-3045	26 Mar 202615:04	–	redhatcve
Vulnrichment	CVE-2026-3045 Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint	13 Mar 202607:23	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 9, 2026 to March 15, 2026)	19 Mar 202616:12	–	wordfence

Vulners

Node

codepeople appointment_booking_calendarRange≤1.6.9.29wordpress

[
  {
    "vendor": "croixhaug",
    "product": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.6.9.29",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-bootstrap.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5970b8d6-0041-4c30-a6ce-fe67ebf415f5
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/lib/td-util/class-td-api-model.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-settings-api.php

Parameter	Position	Path	Description	CWE
public_nonce	path	/wp-json/ssa/v1/embed-inner	Unauthorized exposure of a non-user-bound public_nonce via the embed-inner REST endpoint allows unauthenticated access to sensitive data.	CWE-862
section	path	/wp-json/ssa/v1/settings/{section}	Unauthorized access to admin-only plugin settings via the settings/{section} endpoint enables retrieval of sensitive admin configurations.	CWE-862

17 Jun 2026 10:42Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.0029

SSVC

CWE-862