{"id":"CVE-2026-16540","title":"The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments a…","summary":"The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments a…","severity":"none","published":"2026-08-02","updated":"2026-08-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16540","references":[{"url":"https://wpscan.com/vulnerability/c3829294-c388-4151-9e25-a3eac7b1f1c6/","label":"contact@wpscan.com"}],"tags":["nvd","exploit-available"],"ingestedAt":"2026-08-02T13:18:29.676Z","epss":0.00419,"epssPercentile":0.35912,"exploits":{"github":1,"githubRepos":["https://github.com/huseyn0vs/CVE-2026-16540-SimplyScheduleAppointments"],"checkedAt":"2026-09-23T07:13:50.641Z"},"exploitAvailable":true,"slug":"CVE-2026-16540","body":"## Overview\n\nThe Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4969,"id":"CVE-2026-16540","ts":1788887221706,"field":"exploit_available","old":"false","new":"true"},{"seq":3852,"id":"CVE-2026-16540","ts":1788886354398,"field":"exploit_available","old":"true","new":"false"},{"seq":2684,"id":"CVE-2026-16540","ts":1788883019218,"field":"exploit_available","old":"false","new":"true"},{"seq":1713,"id":"CVE-2026-16540","ts":1788882423986,"field":"exploit_available","old":"true","new":"false"},{"seq":819,"id":"CVE-2026-16540","ts":1788881857373,"field":"exploit_available","old":"false","new":"true"}]}