CVE-2026-65508: WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

Published Aug 6, 2026

Updated

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

Affected Software

1 affected component

WordPress plugin/SimpIy Schedule Appointments<=1.6.12.10

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Simply Schedule Appointments Plugin to a version that resolves this vulnerability.
Fixed in 1.6.12.11

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

CVE-2026-65508 is rated as critical with a CVSS score of 9.3.

To mitigate CVE-2026-65508, update the Simply Schedule Appointments plugin to version 1.6.12.11 or later.

CVE-2026-65508 is an unauthenticated SQL Injection vulnerability affecting Simply Schedule Appointments plugin versions 1.6.12.10 and earlier.

CVE-2026-65508 affects WordPress sites using the Simply Schedule Appointments plugin version 1.6.12.10 and below.

Yes, CVE-2026-65508 can potentially allow attackers to access or manipulate the database content through SQL injection.