CVE-2026-42384: WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability

Synopsis

This is a sensitive data exposure vulnerability in the Simply Schedule Appointments WordPress plugin by NSquared, affecting all versions before 1.6.11.2. The vulnerability is reachable over the network with no authentication required and no special conditions needed, meaning any unauthenticated user on the internet can trigger it. Successful exploitation allows an attacker to read sensitive data from the affected WordPress installation. A patched-image rebuild at version 1.6.11.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress service via HTTP/HTTPS to exploit it.

• AuthenticationNot required

  No account or session credential of any kind is needed; the exposure is reachable by any unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the request can be sent directly with no social engineering required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, memory layout knowledge, or environmental preconditions.

Blast Radius

• An attacker reads sensitive data stored or processed by the Simply Schedule Appointments plugin, which may include appointment details, customer contact information, or configuration values.
• No integrity impact is present; the attacker cannot modify stored records or plugin state through this vulnerability.
• No availability impact is present; the service continues running normally after exploitation.
• Exposed data can be harvested passively at scale with no authentication barrier, making bulk enumeration straightforward.