CVE-2024-7129 is a high severity (CVSS 7.2 in the record) Twig template injection in the Appointment Booking Calendar WordPress plugin, versions before 1.6.7.43. It can lead to remote code execution, but only for a high privilege user such as an administrator. Update to 1.6.7.43 or later.
What's affected
The Appointment Booking Calendar plugin, which WPScan lists under the slug simply-schedule-appointments, in every version before 1.6.7.43. The fixed version is 1.6.7.43, according to both the NVD record and the WPScan entry.
The NVD configuration lists the product as simply_schedule_appointments from nsqua, for WordPress. If your site uses this booking plugin, you are in scope until you update.
How to check if you're exposed
On a site you manage, open the WordPress Plugins screen and read the version under Appointment Booking Calendar. Anything below 1.6.7.43 is vulnerable.
With WP-CLI, run wp plugin list --name=simply-schedule-appointments --fields=name,version,status and compare the version with 1.6.7.43. Run wp plugin update simply-schedule-appointments to move to the current release.
For fleets of sites, include plugin versions in your inventory and match them to advisories. The free in-browser dependency scan covers application dependencies, and the Gold directory lists the CVE so you can see affected ranges in one place.
What to do now
- Update the plugin to 1.6.7.43 or later on every site.
- Review who holds the Administrator role. The flaw needs an admin account, so a stale or shared admin login is the realistic way into it.
- Turn on multi-factor authentication for administrators if you have not already.
- Check the notification templates under the plugin settings for content you did not write. Treat anything unfamiliar as a sign to investigate the account that saved it.
- Remove the plugin if you no longer use it.
Why it matters
The plugin passes text entered in a settings field into the Twig template engine without escaping template syntax. Twig then evaluates it, which is the pattern called server side template injection. The NVD record has no CWE assigned, while WPScan classifies it as command injection, CWE-78.
The two sources also disagree on severity. The NVD record scores it 7.2 (High) with vector AV:N/AC:L/PR:H. WPScan scores it 6.6 (Medium) with AV:N/AC:H/PR:H. Both agree that high privileges are required and that confidentiality, integrity and availability impact is high.
That high privilege requirement lowers urgency for most sites but does not remove it. An attacker who has phished or reused one administrator password can turn a WordPress admin account into code execution on the server. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and the WPScan entry does not report exploitation in the wild.
Try it yourself
See how a fixed version in a package registry shows up against your inventory.
Click through it at your own pace, or open it full screen.
Quick check
Can an anonymous visitor exploit CVE-2024-7129?
No. The record says it requires a high privilege user such as an administrator, and the CVSS vector sets privileges required to high.
Which version fixes it?
Version 1.6.7.43. Anything earlier is affected.
Sources
Last reviewed: 19 October 2026.
