medium6.5
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the reque…
Impact
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
Affected products
| Product | Affected versions |
|---|---|
| Simply Schedule Appointments WordPress Plugin | before 1.6.12.17 |
Versions were read from the advisory text. No structured product data has been published for this record yet.