CVE-2026-92245

{
  "etk_id": "ETK-2026-203",
  "cve_id": "CVE-2026-92245",
  "display_id": "CVE-2026-92245",
  "ghsa_id": "GHSA-3frh-27r2-gj5w",
  "euvd_id": "EUVD-2026-90464",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated information disclosure in Simply Schedule Appointments",
  "summary": "Simply Schedule Appointments for WordPress through version 1.6.12.32 may expose appointment records to unauthenticated requests. An attacker who can reach the affected REST interface may obtain customer personal data and appointment tokens, and those tokens may allow appointment deletion without logging in.",
  "mitigation": "Disable the plugin or restrict unauthenticated access to its appointment REST endpoints until the vendor provides an update. Where removal is not immediately possible, use a reverse proxy or WAF rule to block unauthenticated requests to the affected appointment API path.",
  "vendor": "croixhaug",
  "product": "Simply Schedule Appointments",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.6.12.32"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Simply Schedule Appointments",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3579,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.217603116666666,
  "t0_at": "2026-10-01T03:28:21.953000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T04:46:35.662929+00:00",
      "days": 0.054325346400462965,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T03:28:21.953000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-01T03:28:21.953000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T03:28:21.953000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92245"
    }
  }
}