Medium severity6.5NVD Advisory· Published Aug 15, 2026· Updated Aug 26, 2026

CVE-2026-16541

Description

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Simply Schedule Appointmentsllm-fuzzy
Range: <1.6.12.17
Package: https://wordpress.org/plugins/simply-schedule-appointments

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/8172f778-5dc5-49e8-9967-81215ac187d7/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000