CVE-2026-39694: 
WordPress vulnerability analysis and mitigation

CVE-2026-39694 is a Missing Authorization vulnerability in the NSquared Simply Schedule Appointments WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects Simply Schedule Appointments versions up to and including 1.6.10.2. The vulnerability was published on April 8, 2026, with the CVE assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium), as assessed by both CISA-ADP and Patchstack (GitHub Advisory, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform proper authorization checks when an actor attempts to access restricted resources or perform privileged actions. The vulnerability stems from incorrectly configured access control security levels within the plugin's scheduling functionality, allowing unauthenticated network-based attackers to interact with functionality that should require authentication or elevated privileges. No user interaction or special privileges are required for exploitation, and attack complexity is low (GitHub Advisory, Patchstack).

Successful exploitation could allow unauthorized users to access appointment scheduling functionality without proper permissions, potentially enabling them to view, modify, or manage appointments that should be restricted to authorized administrators or users. The primary impact is on confidentiality (low) and integrity (low), with no availability impact. The sensitivity of the exposed data depends on the nature of appointments stored in the system, which may include personally identifiable information of clients or business-sensitive scheduling data (GitHub Advisory, Patchstack).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.04% per GitHub Advisory), placing it in the 13th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, Patchstack).

Users should upgrade the Simply Schedule Appointments plugin to a version newer than 1.6.10.2 to remediate this vulnerability. A patch has been confirmed as available by Patchstack. As a supplementary measure, administrators should implement the principle of least privilege for appointment scheduling access and regularly audit WordPress plugin access control configurations to ensure proper authorization controls are enforced (GitHub Advisory, Patchstack).