VULNERABILITY INTELLIGENCE

CVE-2026-16541

CVSS score6.5 MEDIUM

EPSS probability0.37%

CISA KEVNot currently listed

Published2026-08-15

Last modified2026-08-26

Description

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.