CVE-2026-39493: WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WordPress plugin Simply Schedule Appointments at version 1.6.9.27 and earlier. The flaw is reachable over the network with no login or credentials required, making it exploitable by any external attacker who can send HTTP requests to a WordPress site running the plugin. Successful exploitation gives an attacker full read access to the database and limited ability to disrupt service availability. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the target WordPress host.

• AuthenticationNot required

  No account, session token, or credentials of any kind are needed to trigger the injection.

• Victim interactionNot required

  The attack is fully server-side; no user action or social engineering is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• Reads any data stored in the WordPress database, including user account records, password hashes, session tokens, plugin configuration, and any customer or appointment data managed by the plugin.
• Scope crosses the vulnerable component boundary (S:C), meaning data from tables beyond the plugin itself, such as WooCommerce orders or other co-located plugin tables, is also readable.
• Limited denial-of-service impact allows an attacker to degrade or disrupt availability of the appointment scheduling service through malformed query execution.