CVE-2026-16540

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently dele...

CVE-2026-16540

creationtimestamp| type| source ---|---|--- 2026-07-22 20:00:03+00:00| seen| Telegram/6xbzrZHKWlySmltoOKJREHJqOUlaPiDVN1mUGUuwPSWTXlo 2026-07-22 22:00:03+00:00| seen| Telegram/oTCcthwftzUyvaLQLtY7FvG4NjMlnlzCmFsPRxIzpTLAzWg 2026-07-23 00:00:04+00:00| published-proof-of-concept|...