CVE-2026-16541
Received
Received - Intake
Unauthorized User Data Exposure in Simply Schedule Appointments WordPress Plugin
Vulnerability report for CVE-2026-16541, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-15
Last updated on: 2026-08-15
Assigner: WPScan
Description
Description
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| simply_schedule_appointments | simply_schedule_appointments | to 1.6.12.17 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
