[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-74dpTnWjjEFmK9R-MD7n51fr_cZys9ysuKiP5UpuKo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":36},"CVE-2026-57812","appointment-booking-calendar-simply-schedule-appointments-booking-plugin-missing-authorization","Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003C= 1.6.12.4 - Missing Authorization","The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.6.12.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.","simply-schedule-appointments",null,"\u003C=1.6.12.4","1.6.12.6","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-09 00:00:00","2026-07-14 19:33:55",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7249469c-a46d-40fc-bf05-ae0bef72e655?source=api-prod",6,[22,23,24,25,26,27,28],"CHANGELOG.md","includes\u002Fclass-appointment-model.php","includes\u002Fclass-elementor.php","includes\u002Fclass-paypal-ipn-listener.php","readme.txt","simply-schedule-appointments.php","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57812\n\n## 1. Vulnerability Summary\n**CVE-2026-57812** is a Missing Authorization vulnerability in the **Simply Schedule Appointments (SSA)** plugin (versions \u003C= 1.6.12.4). The vulnerability exists because certain REST API endpoints (specifically those handling **notices** and **templates**) fail to perform adequate capability checks. \n\nThe `CHANGELOG.md` for version 1.6.12.0 mentions an attempt to \"tighten notices\u002Ftemplates REST auth\" and \"Remove public-nonce fallback.\" This indicates that these endpoints previously accepted a \"public nonce\" (intended for unauthenticated booking interactions) as a valid authorization token for administrative actions. The existence of this CVE up to version 1.6.12.4 suggests the fix was incomplete or specific endpoints were overlooked.\n\n## 2. Attack Vector Analysis\n*   **Endpoint**: `\u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices` or `\u002Fwp-json\u002Fssa\u002Fv1\u002Ftemplates`\n*   **HTTP Method**: `GET` (for information exposure) and `POST\u002FPUT\u002FDELETE` (for unauthorized modification).\n*   **Authentication**: Unauthenticated.\n*   **Authorization**: The attacker leverages the `public_nonce` provided to all users on pages where the SSA booking form is present.\n*   **Preconditions**: At least one page must contain the SSA booking shortcode `[ssa_booking]` to expose the public nonce.\n\n## 3. Code Flow\n1.  The plugin initializes various API handlers in `simply-schedule-appointments.php` (e.g., `$this->notices_api`, `$this->templates_api`).\n2.  These classes register REST routes under the `ssa\u002Fv1` namespace using `register_rest_route`.\n3.  The `permission_callback` for these routes likely checks if the user is an administrator OR if a valid `public_nonce` is provided in the `X-WP-Nonce` header or `_wpnonce` parameter.\n4.  In the vulnerable version, endpoints like `notices` still permit the `public_nonce` fallback, allowing unauthenticated users to perform actions like dismissing administrative notifications or modifying templates.\n\n## 4. Nonce Acquisition Strategy\nThe \"public nonce\" is required for the REST API to accept requests from the frontend booking app.\n1.  **Trigger Script Loading**: SSA enqueues its scripts and localizes data on any page containing the booking shortcode.\n2.  **Create Page**:\n    `wp post create --post_type=page --post_title=\"Booking\" --post_status=publish --post_content='[ssa_booking]'`\n3.  **Extract Nonce**:\n    Navigate to the newly created page and use `browser_eval` to extract the nonce from the global configuration object.\n    *   **JS Variable**: `window.SSA_Booking` (inferred from SSA source patterns).\n    *   **Nonce Key**: `nonce` or `public_nonce`.\n    *   **Command**: `browser_eval(\"window.SSA_Booking?.nonce\")`\n\n## 5. Exploitation Strategy\nWe will attempt to unauthentically access and modify the plugin's \"Notices\" (administrative messages), which fits the \"Missing Authorization\" and \"Low Integrity Impact\" (CVSS 5.3) profile.\n\n### Step 1: Discover Existing Notices\n*   **Request**: `GET \u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices`\n*   **Headers**: `X-WP-Nonce: [EXTRACTED_NONCE]`\n*   **Goal**: List all administrative notices. If successful, this confirms the missing authorization on the `GET` handler.\n\n### Step 2: Perform Unauthorized Action (Dismiss Notice)\n*   **Request**: `POST \u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices\u002Fdismiss` (or similar endpoint identified in Step 1)\n*   **Payload**: `{\"notice_id\": \"some-id\"}`\n*   **Headers**: `Content-Type: application\u002Fjson`, `X-WP-Nonce: [EXTRACTED_NONCE]`\n*   **Goal**: Dismiss an admin notice as an unauthenticated user.\n\n### Step 3: Modify Templates (Optional\u002FAlternative)\n*   **Request**: `GET \u002Fwp-json\u002Fssa\u002Fv1\u002Ftemplates`\n*   **Goal**: View email\u002Fnotification templates to confirm broad authorization bypass.\n\n## 6. Test Data Setup\n1.  **Plugin Installation**: Install SSA version 1.6.12.4.\n2.  **Generate a Notice**: Ensure there is at least one active notice in the SSA dashboard (e.g., by not completing the setup wizard or inducing a minor configuration warning).\n3.  **Public Page**: Create a page with the shortcode `[ssa_booking]` at the slug `\u002Fbooking-page`.\n\n## 7. Expected Results\n*   The `GET \u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices` request should return a `200 OK` with a JSON array of notices, even though the request is unauthenticated.\n*   The `POST` request to dismiss or modify a notice should return `200 OK` and the notice should no longer appear in the admin dashboard.\n\n## 8. Verification Steps\n1.  **Verify via WP-CLI**:\n    Check the database for dismissed notices (often stored in `wp_options` under `ssa_settings` or `ssa_dismissed_notices`):\n    `wp option get ssa_dismissed_notices`\n2.  **Verify via Admin UI**: Log in as an admin and verify that the targeted notice has disappeared from the \"Simply Schedule Appointments\" dashboard.\n\n## 9. Alternative Approaches\nIf the `notices` endpoint is already partially patched, target the `templates` or `support_status` endpoints:\n*   `GET \u002Fwp-json\u002Fssa\u002Fv1\u002Ftemplates`\n*   `GET \u002Fwp-json\u002Fssa\u002Fv1\u002Fsupport_status`\n*   `POST \u002Fwp-json\u002Fssa\u002Fv1\u002Fsettings` (Check if the \"Unauthenticated settings exposure\" fix from 1.6.11.0 was regressed or incomplete).\n\nIf `window.SSA_Booking` is not the correct variable, search the page source for `wp-json\u002Fssa\u002Fv1` to find the localization script. Look for keys like `rest_nonce`, `public_nonce`, or `ssa_nonce`.","gemini-3-flash-preview","2026-07-15 22:05:23","2026-07-15 22:06:08",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.6.12.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags\u002F1.6.12.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimply-schedule-appointments.1.6.12.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags\u002F1.6.12.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimply-schedule-appointments.1.6.12.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags"]