CVE-2025-13754

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13754", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-26T19:11:33.301Z", "datePublished": "2025-12-19T06:48:22.315Z", "dateUpdated": "2026-04-08T16:36:07.329Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:07.329Z"}, "affected": [{"vendor": "croixhaug", "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.9.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services."}], "title": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-11-11T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-26T19:26:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-18T18:13:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-19T18:47:41.272315Z", "id": "CVE-2025-13754", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-19T18:47:49.526Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13754", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T18:47:41.272315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-19T18:47:46.643Z"}}], "cna": {"title": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "croixhaug", "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.6.9.16"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-11T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-26T19:26:57.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-18T18:13:50.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-19T06:48:22.315Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13754", "state": "PUBLISHED", "dateUpdated": "2025-12-19T18:47:49.526Z", "dateReserved": "2025-11-26T19:11:33.301Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-19T06:48:22.315Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin", "vendor": "croixhaug", "versions": [{"lessThanOrEqual": "1.6.9.16", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services."}], "id": "CVE-2025-13754", "lastModified": "2026-06-17T08:34:41.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13754", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-19T18:47:41.272315Z", "version": "2.0.3"}}]}, "published": "2025-12-19T07:16:00.443", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421427/simply-schedule-appointments/trunk/includes/class-shortcodes.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:19:57.762587+00:00", "value": {"mitigation_remediation": ["Update the Simply Schedule Appointments Booking Plugin to the latest available version that contains the fix for the embed endpoint authorization.", "If an update cannot be applied immediately, block or restrict access to /wp-json/ssa/v1/embed-inner-admin using a web application firewall or server access control so that unauthenticated requests are denied.", "Check other plugin endpoints for similar missing authorization to prevent additional sensitive information exposure."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects croixhaug's Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin on all WordPress installations running versions up to and including 1.6.9.16. Subsequent releases are not identified as vulnerable based on the current information.", "description_and_impact": "The vulnerability lies in the plugin's admin embed endpoint /wp-json/ssa/v1/embed-inner-admin, which can be accessed without authentication and returns configuration data such as staff names, business names, and in premium versions, API keys for external services. An unauthenticated attacker can send a simple HTTP request to retrieve this information, compromising the confidentiality of sensitive business configuration and potentially exposing credentials to integrated services.", "risk_and_exploitability": "This issue has a CVSS score of 5.3, indicating moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw simply by accessing the unauthenticated endpoint, which requires no special privileges or additional conditions."}}}}, "created": "2025-12-21T21:13:20.390561+00:00", "updated": "2026-04-22T20:30:26.770059+00:00", "vendors": ["croixhaug", "croixhaug$PRODUCT$appointment_booking_calendar", "wordpress", "wordpress$PRODUCT$wordpress"]}