CVE-2025-11723
Sensitive Information Exposure in Simply Schedule Appointments Plugin
Publication date: 2026-01-06
Last updated on: 2026-01-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| simply_schedule_appointments | simply_schedule_appointments_booking_plugin | to 1.6.9.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-330 | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Simply Schedule Appointments Booking Plugin for WordPress (up to version 1.6.9.5) where a hardcoded fall-back salt is used in the hash() function. Because of this, unauthenticated attackers can generate valid tokens across sites running the plugin that have not manually set a salt in the wp-config.php file. This allows attackers to access booking information and potentially make unauthorized modifications. [1]
How can this vulnerability impact me? :
The vulnerability can allow unauthenticated attackers to access sensitive booking information and make unauthorized changes to appointments. This could lead to privacy breaches, manipulation of booking data, and potential disruption of appointment scheduling on affected WordPress sites. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the version of the Simply Schedule Appointments Booking Plugin installed on your WordPress site. Versions up to and including 1.6.9.5 are vulnerable. Specifically, look for the use of the hardcoded fallback salt in the hash() function. Since the vulnerability involves token generation using a hardcoded salt, you might also monitor for unauthorized access attempts to booking information or modifications. However, no specific detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Simply Schedule Appointments Booking Plugin to version 1.6.9.6 or later. This update replaces the insecure hash() function usage with a site-unique hash, removes deprecated hashing code, and fixes related security issues. Additionally, ensure that a unique salt is set manually in the wp-config.php file to prevent fallback to the hardcoded salt. [1]