CVE-2026-1708
Published: 11 March 2026
Summary
CVE-2026-1708 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-1708 is a blind SQL injection vulnerability affecting the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, in all versions up to and including 1.6.9.27. The issue resides in the `db_where_conditions` method of the `TD_DB_Model` class, which fails to sanitize the `append_where_sql` parameter when it is passed through JSON request bodies. The method only checks for the parameter's presence in the `$_REQUEST` superglobal, allowing it to be injected and appended to database queries without validation.
Unauthenticated attackers can exploit this vulnerability by obtaining a valid `public_token`, which is inadvertently exposed during the plugin's booking flow. With this token, attackers can send JSON payloads containing arbitrary SQL commands via the `append_where_sql` parameter, enabling them to extract sensitive information from the database. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network accessibility, low complexity, no privileges required, and high confidentiality impact with no integrity or availability disruption.
The provided references link to specific lines in the plugin's source code on the WordPress plugin trac repository, highlighting the vulnerable code paths in files such as `class-appointment-model.php` (lines 1340 and 1413) and `class-td-db-model.php` (lines 1019 and 1025), as well as updates in the trunk version. No explicit patch or mitigation details are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11117
Vulnerability details
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class failing to…
more
prevent the `append_where_sql` parameter from being passed through JSON request bodies, while only checking for its presence in the `$_REQUEST` superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the `append_where_sql` parameter in JSON payloads granted they have obtained a valid `public_token` that is inadvertently exposed during the booking flow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Blind SQL injection in public-facing WordPress plugin directly enables exploitation of public-facing applications for unauthenticated data exfiltration from the database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents blind SQL injection by requiring validation and sanitization of untrusted inputs like the append_where_sql parameter in JSON payloads before appending to database queries.
Mitigates the specific flaw in the WordPress plugin by mandating timely identification, testing, and installation of patches for known vulnerabilities like CVE-2026-1708.
Enables proactive discovery and remediation of SQL injection vulnerabilities through regular scanning, directly applicable to identifying and addressing this plugin flaw.