CVE-2026-3045: 
WordPress vulnerability analysis and mitigation

CVE-2026-3045 is an unauthorized access vulnerability (Missing Authorization, CWE-862) in the Simply Schedule Appointments WordPress plugin ("Appointment Booking Calendar — Simply Schedule Appointments") that allows unauthenticated attackers to read sensitive admin-only plugin settings. All versions up to and including 1.6.9.29 are affected. The vulnerability was published on March 13, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Wordfence).

The vulnerability stems from two compounding weaknesses in the plugin's REST API authorization logic (CWE-862 — Missing Authorization). First, a non-user-bound public_nonce is exposed to unauthenticated users via the public /wp-json/ssa/v1/embed-inner endpoint. Second, the get_item() method in SSA_Settings_Api uses nonce_permissions_check() for authorization — which accepts this public nonce — but fails to call remove_unauthorized_settings_for_current_user() to strip restricted fields before returning data. An unauthenticated attacker can therefore supply the leaked public nonce to the /wp-json/ssa/v1/settings/{section} endpoint and retrieve admin-only configuration data. Additionally, exposed appointment tokens enable modification or cancellation of existing appointments (Feedly, Infinitsec).

Successful exploitation allows unauthenticated remote attackers to access sensitive administrator-level plugin settings, including the administrator email address, phone number, internal access tokens, notification configurations, and developer settings. Exposure of appointment tokens further enables attackers to modify or cancel scheduled appointments, impacting business operations and data integrity. While availability and code execution are not directly affected, the leaked credentials and tokens could facilitate follow-on attacks such as phishing, account takeover, or abuse of integrated third-party services (Feedly, Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker once the public nonce is obtained. The EPSS score is 0.033%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable by Qualys scanner (detection ID 531159) (Feedly).

1. Reconnaissance: Identify WordPress sites running the Simply Schedule Appointments plugin (versions ≤ 1.6.9.29) using tools like WPScan, Shodan, or by checking /wp-content/plugins/simply-schedule-appointments/ for version indicators.
2. Obtain the public nonce: Send an unauthenticated GET request to the public REST endpoint: GET /wp-json/ssa/v1/embed-inner and extract the public_nonce value from the response.
3. Query restricted settings: Use the obtained nonce to call the settings endpoint with the desired section, e.g.: GET /wp-json/ssa/v1/settings/notifications with the nonce included as a header or parameter (X-WP-Nonce: <public_nonce>).
4. Extract sensitive data: Parse the JSON response to retrieve admin email, phone number, internal access tokens, notification configurations, and developer settings.
5. Abuse appointment tokens: Use any exposed appointment tokens to send authenticated requests to modify or cancel existing appointments via the plugin's API endpoints (Feedly, Infinitsec).

• Network: Unusual unauthenticated GET requests to /wp-json/ssa/v1/embed-inner followed immediately by requests to /wp-json/ssa/v1/settings/{section} from the same IP address; repeated enumeration of multiple settings sections (e.g., notifications, developer, general) in rapid succession.
• Logs: WordPress access logs showing unauthenticated REST API calls to /wp-json/ssa/v1/settings/ with a valid nonce but no associated logged-in user session; HTTP 200 responses to these endpoints from unknown or external IPs.
• Application Behavior: Unexpected appointment cancellations or modifications not initiated by known users or administrators; changes to appointment records without corresponding admin activity in WordPress audit logs.

Users should update the Simply Schedule Appointments plugin to a version above 1.6.9.29 that addresses the missing authorization check. Until a patch is applied, administrators can restrict access to the WordPress REST API for unauthenticated users using a security plugin (e.g., Wordfence, iThemes Security) or by adding authentication requirements to REST API routes via functions.php. Rotating any exposed access tokens, API keys, and credentials stored in plugin settings is strongly recommended as a post-exposure measure (Wordfence, Sucuri).

Wordfence included CVE-2026-3045 in its weekly WordPress vulnerability report for the week of March 9–15, 2026, highlighting it as a notable unauthenticated data exposure issue (Wordfence). Sucuri also referenced the vulnerability in its March 2026 vulnerability patch roundup (Sucuri). The vulnerability received coverage from security aggregators including RedPacket Security and The Hacker Wire, and was shared on social media platforms including Mastodon and Twitter/X, though no significant researcher controversy or debate was noted.