CVE-2026-16541
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Simply Schedule Appointments WordPress plugin before version 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see. This allows users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
Risk Assessment
Risk of privacy breach by exposing personal data of users, which may lead to legal liability and loss of trust.
Recommendation
Update the Simply Schedule Appointments plugin to version 1.6.12.17 or later and review staff role permissions.
Original NVD description (English source)
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.