7.5
High
CVE-2026-16540 The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment…
Description
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simply Schedule Appointments 1.6 | earliest → < 1.6.12.6 | 1.6.12.6 |
Other CVEs of Simply Schedule Appointments
The 4 CVEs of Simply Schedule Appointments →
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some…
6.5
Medium
CVE-2026-15254
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an…
6.5
Medium
CVE-2026-13400
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and…
6.1
Medium