Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, including usernames, email addresses, and password hashes.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-19 | 1 | General1 |
| 2026-03-20 | 1 | General1 |
| 2026-03-23 | 1 | Disclosure1 |
CVE-2026-3658 The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all ver… https://www.cve.org/CVERecord?id=CVE-2026-3658
Post summary
A SQL injection vulnerability (CVE‑2026‑3658) has been disclosed in the Appointment Booking Calendar WordPress plugin, affecting all versions via the 'fields' parameter.
CVE Alert: CVE-2026-3658 - croixhaug - Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin - https://www.redpacketsecurity.com/cve-alert-cve-2026-3658-croixhaug-appointment-booking-calendar-simply-schedule-appointments-booking-plugin/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-3658 #croixhaug #appointment-booking-calendar-simply-schedule-appointments-booking-plugin
Post summary
The post announces CVE‑2026‑3658 for the croixhaug Appointment Booking Calendar plugin and links to an external alert, but offers no deeper technical or exploit information.
CVE-2026-3658 SQL Injection in Simply Schedule Appointments WordPress Plugin Before 1.6.10.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3658
Post summary
The text merely announces a SQL Injection vulnerability in the Simply Schedule Appointments plugin prior to version 1.6.10.0, with no additional detail on exploitation or remediation.