CVEvulnerability

CVE-2026-16540

7.5 HIGH Published 2026-08-02 Modified 2026-08-26 Official page ↗
Status
Deferred
Published
2026-08-02
Last modified
2026-08-26
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863

Description

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References