CVE-2025-11723: 
WordPress vulnerability analysis and mitigation

CVE-2025-11723 is a Sensitive Information Exposure vulnerability in the "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin" for WordPress, affecting all versions up to and including 1.6.9.5. The flaw exists in the plugin's hash() function, which relies on a hardcoded fallback salt when no custom salt has been configured in wp-config.php. This allows unauthenticated attackers to forge valid tokens and access or modify booking information across any affected site. It was published on January 5–6, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) by Wordfence (Wordfence, NVD).

The root cause is classified as CWE-330 (Use of Insufficiently Random Values): the plugin's hash() function falls back to a hardcoded salt when the WordPress installation has not defined a custom salt in wp-config.php. Because the fallback salt is static and publicly known (embedded in the plugin code), any unauthenticated attacker can replicate the token generation logic to produce cryptographically valid tokens for any booking on any site running the vulnerable plugin without a custom salt. This is consistent with CAPEC-59 (Session Credential Falsification through Prediction) and CAPEC-485 (Signature Spoofing by Key Recreation) attack patterns (Wordfence, NVD). The attack requires no authentication, no user interaction, and is exploitable over the network with low complexity.

Successful exploitation allows unauthenticated remote attackers to generate valid booking tokens, exposing sensitive booking information (confidentiality impact) and enabling unauthorized modifications to existing bookings (integrity impact). There is no direct availability impact. The vulnerability is particularly broad in scope because it affects all sites running the plugin that have not manually configured a salt in wp-config.php — a common default state — meaning a single hardcoded salt can be leveraged against many sites simultaneously (Wordfence, NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11723 as of the available data. The EPSS score is approximately 0.05%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it theoretically straightforward to exploit against sites without a custom salt configured (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Simply Schedule Appointments Booking Plugin (versions ≤ 1.6.9.5) using tools like WPScan, Shodan, or by inspecting plugin asset paths in page source.
2. Determine salt status: Assess whether the target site has a custom salt defined in wp-config.php. Sites without a custom salt use the plugin's hardcoded fallback salt, making them vulnerable.
3. Replicate token generation: Using the known hardcoded fallback salt extracted from the plugin source code, replicate the hash() function logic locally to generate valid booking tokens for target booking IDs.
4. Access booking data: Submit crafted requests to the plugin's booking endpoints with the forged token to retrieve sensitive booking information (e.g., customer names, contact details, appointment times).
5. Modify bookings: Use the forged token to send modification requests to the booking management endpoints, altering or canceling existing appointments without authorization (Wordfence).

• Network: Unusual or repeated unauthenticated HTTP requests to Simply Schedule Appointments booking endpoints (e.g., endpoints handling booking lookups or modifications) with token parameters that were not generated through normal user flows.
• Logs: WordPress access logs showing unauthenticated requests to booking management or calendar API endpoints with valid-looking hash tokens, especially from unfamiliar IP addresses or at unusual times.
• Application: Unexpected modifications, cancellations, or access to booking records with no corresponding authenticated user session in WordPress logs.

Update the Simply Schedule Appointments Booking Plugin to version 1.6.9.6 or later, which resolves the hardcoded fallback salt issue (Plugin Changeset). As an immediate workaround for sites that cannot update immediately, manually define a unique, cryptographically random salt in the wp-config.php file, which prevents the plugin from falling back to the hardcoded value. Site administrators should also audit booking records for unauthorized modifications following any period of exposure (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for January 5–11, 2026 (Wordfence Blog). Sucuri also referenced the vulnerability in their January 2026 vulnerability patch roundup (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.