CVE-2026-6937 Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint

🗓️ 28 May 2026 07:43:43Reported by WordfenceType

There is unauthenticated modification and personal data exposure via the bulk appointment interface in Simply Schedule Appointments up to version 1.6.11.8.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-6937	28 May 202607:43	–	attackerkb
Circl	CVE-2026-6937	28 May 202611:10	–	circl
CNNVD	WordPress plugin Appointment Booking Calendar 安全漏洞	28 May 202600:00	–	cnnvd
CVE	CVE-2026-6937	28 May 202607:43	–	cve
EUVD	EUVD-2026-32747	28 May 202607:43	–	euvd
NVD	CVE-2026-6937	28 May 202609:16	–	nvd
Patchstack	WordPress Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification vulnerability	27 May 202619:43	–	patchstack
Positive Technologies	PT-2026-44216	28 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-6937	5 Jun 202619:32	–	redhatcve
Vulnrichment	CVE-2026-6937 Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint	28 May 202607:43	–	vulnrichment

[
  {
    "vendor": "croixhaug",
    "product": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.6.11.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/lib/td-util/class-td-api-model.php
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-appointment-model.php
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.10.0/includes/lib/td-util/class-td-api-model.php
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.10.0/includes/class-bootstrap.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ef0f5f9d-788a-4cf8-9747-ada076a69a1f
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-bootstrap.php
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-api-model.php
plugins	www.plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.10.0/includes/class-appointment-model.php
plugins	www.plugins.trac.wordpress.org/changeset