CVE-2025-11723 Hardcoded credentials in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Unauthenticated attackers can access and modify booking data by exploiting a hardcoded salt in the Simply Schedule Appointments plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11723?
CVE-2025-11723 is a medium-severity vulnerability in croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin, published on 6 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.5 via the hash() function due to use of a hardcoded fall-back salt. This makes it possible for unauthenticated attackers to generate a valid token across sites running the plugin that have not manually set a salt in the wp-config.php file and access booking information that will allow them to make modifications.
Weakness: CWE-330
Which versions are affected by CVE-2025-11723?
How do I fix CVE-2025-11723?
No fix has been published for CVE-2025-11723 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11723 being exploited?
There is no known exploitation of CVE-2025-11723 in the wild and no public exploit code.
Sources
Also known as GHSA-86xh-gm7c-mpg4.