CVE-2026-1708: 
WordPress vulnerability analysis and mitigation

CVE-2026-1708 is a blind SQL injection vulnerability in the Simply Schedule Appointments (Appointment Booking Calendar) plugin for WordPress, affecting all versions up to and including 1.6.9.27. The flaw allows unauthenticated remote attackers to append arbitrary SQL commands to database queries and extract sensitive information, provided they can obtain a valid public_token exposed during the booking flow. It was published on March 11, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The db_where_conditions method in the TD_DB_Model class fails to sanitize the append_where_sql parameter when it is supplied via a JSON request body, because the security check only inspects the $_REQUEST PHP superglobal — which does not include raw JSON body data. An attacker can bypass this check by sending the malicious parameter in a JSON payload rather than a standard form-encoded request, allowing arbitrary SQL to be appended to existing queries. The attack is network-accessible, requires no privileges, and no user interaction, but does require a valid public_token that is inadvertently leaked during the normal appointment booking flow (Feedly, Infinitsec).

Successful exploitation results in high confidentiality impact, enabling an unauthenticated attacker to extract arbitrary data from the WordPress database — including user credentials (hashed passwords), email addresses, personal booking information, and potentially secret keys stored in the database. Integrity and availability are not directly impacted by this vulnerability. If credential data is recovered and cracked, attackers could escalate to full site compromise or lateral movement within a shared hosting environment (Feedly, Sucuri).

The EPSS score is 0.00121 (approximately 0.12%), indicating a currently low probability of widespread exploitation, though the vulnerability is technically straightforward to exploit once a public_token is obtained. No public PoC exploit code has been confirmed, but the vulnerability has been indexed by multiple threat intelligence and exploit-tracking platforms (Exploit-Intel, Feedly). There is no confirmed in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest available data.

1. Reconnaissance: Identify WordPress sites running the Simply Schedule Appointments plugin (versions ≤ 1.6.9.27) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain a public_token: Initiate a legitimate appointment booking flow on the target site. Intercept the HTTP traffic (e.g., using Burp Suite) to capture the public_token value that is exposed in the booking API responses.
3. Craft a malicious JSON payload: Construct a JSON request body targeting the vulnerable booking/calendar API endpoint, including the append_where_sql parameter with a blind SQL injection payload (e.g., time-based or boolean-based payloads such as AND SLEEP(5)-- or AND 1=1--).
4. Send the request: Submit the crafted JSON POST request to the vulnerable endpoint, including the captured public_token for authentication. The $_REQUEST check is bypassed because the parameter is in the JSON body, not in standard form data.
5. Extract data: Use automated blind SQL injection tools (e.g., sqlmap with a custom tamper script or manual boolean/time-based enumeration) to iteratively extract database contents, including WordPress user table credentials and other sensitive data (Infinitsec, Feedly).

• Network: Unusual POST requests to Simply Schedule Appointments REST API endpoints (e.g., /wp-json/ssa/v1/ or similar) containing JSON bodies with SQL keywords (SLEEP, UNION, SELECT, AND 1=, --) in the append_where_sql field; repeated requests with slight payload variations indicative of blind SQL injection enumeration.
• Logs: WordPress or web server access logs showing high-frequency POST requests to booking API endpoints from a single IP or small IP range; requests with abnormally long or encoded JSON bodies; time-delayed responses (indicative of SLEEP()-based payloads) logged in server response time metrics.
• Application: Unexpected database query errors or slow query log entries in MySQL/MariaDB referencing the plugin's table queries with appended SQL fragments.

At the time of initial disclosure (March 11, 2026), no patched version was confirmed available for all affected versions through 1.6.9.27. Site administrators should monitor the plugin's official WordPress repository for an updated release and upgrade immediately upon availability. As an interim workaround, consider disabling the Simply Schedule Appointments plugin until a patch is applied, or implement a Web Application Firewall (WAF) rule to block POST requests containing SQL keywords in JSON bodies targeting the plugin's API endpoints. Restricting public access to booking endpoints where operationally feasible can also reduce exposure (Wordfence, Sucuri).

Wordfence included CVE-2026-1708 in its weekly WordPress vulnerability report for March 9–15, 2026, highlighting it as a notable unauthenticated SQL injection risk (Wordfence). Sucuri referenced it in their March 2026 vulnerability patch roundup (Sucuri). RedPacketSecurity amplified the alert on Mastodon and their blog, and the CVE received brief coverage on Bluesky via automated CVE tracking accounts (RedPacketSecurity). Community reaction has been moderate, consistent with a high-severity but not immediately weaponized WordPress plugin vulnerability.