CVE-2025-13754

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure

View on CVE.org

Published Dec 19, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services.

Analysis

Technical impact

The vulnerability lies in the plugin's admin embed endpoint /wp-json/ssa/v1/embed-inner-admin, which can be accessed without authentication and returns configuration data such as staff names, business names, and in premium versions, API keys for external services. An unauthenticated attacker can send a simple HTTP request to retrieve this information, compromising the confidentiality of sensitive business configuration and potentially exposing credentials to integrated services.

Affected Systems

The vulnerability affects croixhaug's Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin on all WordPress installations running versions up to and including 1.6.9.16. Subsequent releases are not identified as vulnerable based on the current information.

Risk and Exploitability

This issue has a CVSS score of 5.3, indicating moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw simply by accessing the unauthenticated endpoint, which requires no special privileges or additional conditions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

croixhaug

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.6.9.16

No data.

Vendor	Product	Versions
Croixhaug	Appointment Booking Calendar	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Simply Schedule Appointments Booking Plugin to the latest available version that contains the fix for the embed endpoint authorization.
If an update cannot be applied immediately, block or restrict access to /wp-json/ssa/v1/embed-inner-admin using a web application firewall or server access control so that unauthenticated requests are denied.
Check other plugin endpoints for similar missing authorization to prevent additional sensitive information exposure.

Generated by OpenCVE AI on April 22, 2026 at 20:19 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.349% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve

History

Dec 21, 2025 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Croixhaug Croixhaug appointment Booking Calendar Wordpress Wordpress wordpress
Vendors & Products		Croixhaug Croixhaug appointment Booking Calendar Wordpress Wordpress wordpress

Dec 19, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 19, 2025 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services.
Title		Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`