CVE-2026-84764

Overview

Summary

Simply Schedule Appointments through 1.6.12.23 has an unauthenticated CSRF vulnerability. Anthony Green's research showed that the plugin could discard a failed REST nonce check and accept a forged request under a logged-in administrator's session.

Vulnerability Classification

Security Impact

An attacker can induce an authenticated administrator to perform unintended privileged actions. The original lab demonstrated deletion of selected appointment records and anonymous retrieval of a generated backup containing synthetic customer data. The attacker does not need an account, but does need the administrator's browser to carry an active session. The published CVSS 3.1 score is High (8.8); Patchstack separately labels its operational priority Low.

Affected Products

Simply Schedule Appointments WordPress plugin versions 1.6.12.23 and earlier. The CVE record lists unaffected as its default status for versions outside the stated range.

Component: REST authentication error handling

Fixed version: 1.6.12.24 or later

Technical Details

In the tested 1.6.12.15 release, the plugin's rest_authentication_errors filter returned true for its REST namespace, overwriting an authentication error raised by WordPress core. A missing nonce caused core to clear the current user, but a present, invalid nonce produced an error while leaving the user context intact. Discarding that error allowed a later capability check to succeed under the administrator's identity. The route-prefix check used the parsed route correctly; the defect was converting authentication failure into success. A state-changing GET endpoint made the flaw reachable through a cross-site top-level navigation.

This public record provides enough information to identify the vulnerability and its root cause without unnecessarily publishing weaponized exploit material.

Research method

How We Investigated

1. 1. Test missing and invalid credentials separately

   The assessment varied the session and nonce independently. An anonymous request and an administrator request without a nonce were denied, while the same administrator session with an invalid nonce was accepted. That difference exposed the failure that a missing-nonce test alone would have missed.

2. 2. Use controls to isolate the responsible code

   The lab reseeded appointment rows before each request and checked the database afterward. A valid request supplied the expected baseline. Deactivating the plugin restored WordPress's invalid-nonce rejection, and a core REST route rejected the same invalid nonce. Together, those controls tied the behavior to the plugin's authentication filter.

3. 3. Verify delivery in a real browser

   Chromium withheld the session cookie from a cross-site fetch, so that attempt failed. A top-level navigation from a different site carried the cookie and reached the state-changing GET handler. Two seeded cancelled appointments were removed while a booked appointment remained. The negative fetch result matters: browser delivery must be demonstrated, not inferred from a successful HTTP replay.

Research evidence

Controlled Lab Validation

The original assessment used Simply Schedule Appointments 1.6.12.15 on WordPress 7.0.2 in an isolated lab with synthetic appointment data. This tested version is within the broader affected range later published by Patchstack.

Each request started with freshly seeded records, so the result measures state change independently. The browser test confirmed cross-site navigation as a delivery path in the tested configuration. These findings summarize the original evidence; they do not claim a new test of version 1.6.12.24 or that every REST endpoint behaved identically.

Attack Requirements

• The site must run an affected Simply Schedule Appointments version.
• A victim must have an active session with permission to perform the targeted action; the lab used an administrator.
• The victim must visit attacker-controlled content that triggers the forged request.
• The attacker needs no WordPress account. Cross-site fetch and top-level navigation behaved differently in the tested browser.

Remediation

• Confirm the installed plugin version on every site that uses Simply Schedule Appointments.
• In a staging environment, test anonymous, missing-nonce, invalid-nonce, and valid requests independently with synthetic records.
• For custom REST integrations, preserve authentication errors and enforce authorization at each endpoint.
• Keep state-changing operations off GET routes and test browser cookie behavior across genuinely different sites.
• Review generated appointment exports and backups so customer data is not publicly accessible.

Disclosure Timeline

1. August 10, 2026

   Report submitted

   Patchstack's public timeline records Anthony Green's report on this date.

2. September 2, 2026

   Advisory and CVE record published

   Patchstack published the CSRF advisory, credited Anthony Green, and identified 1.6.12.24 as the fixed version.

The original research tested 1.6.12.15. The public CVE extends the affected range through 1.6.12.23 and identifies 1.6.12.24 as unaffected. Patchstack's Low priority label is distinct from the CVE's High CVSS severity.

Researcher Credit

• Anthony Green [antnation] — Green Hat Security

Coordination and CVE Attribution

Anthony Green of Green Hat Security reported the finding through the Patchstack Bug Bounty Program. Patchstack coordinated disclosure and assigned the CVE ID.

Green Hat Security did not reserve or assign the CVE ID.

The original research tested 1.6.12.15. The public CVE extends the affected range through 1.6.12.23 and identifies 1.6.12.24 as unaffected. Patchstack's Low priority label is distinct from the CVE's High CVSS severity.

References

• Official CVE record ↗
• Patchstack advisory ↗
• WordPress plugin listing ↗