CVE-2026-39495

A SQL Injection vulnerability (CVE-2026-39495) has been identified in NSquared's Simply Schedule Appointments plugin, affecting versions up to and including 1.6.9.27. The flaw allows attackers to perform blind SQL injection attacks through improper neutralization of special elements in SQL commands. This vulnerability is rated HIGH severity with a CVSS score of 8.5, indicating significant risk to affected systems. The attack requires low complexity and can be executed remotely by authenticated users without user interaction, though it operates across trust boundaries (CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). While the vulnerability provides high confidentiality impact through potential data disclosure, integrity impact is not expected, and availability impact is limited. The FAUCET Risk Score of 41.0/100 reflects moderate concern. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat intelligence hotlists. The EPSS score of 0.00033 suggests minimal current exploitation probability. Organizations running vulnerable versions should prioritize patching to mitigate the risk of unauthorized data access through SQL injection techniques.