CVE-2026-16540

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently dele...

CVE-2026-16540

The Simply Schedule Appointments WordPress plugin (versions before 1.6.12.6 ) is vulnerable to an incorrect authorization flaw during bulk appointment operations. The get_items_permissions_check function only validates ownership of a single appointment using an id_token, but the purge_appointment...