CVE-2026-16540

The CVE-2026-16540 affects the Simply Schedule Appointments WordPress plugin prior to 1.6.12.6. A REST endpoint on wp-json/ssa/v1/appointments/purge allows unauthenticated users to bypass per-appointment scoping and, in premium editions, to mass-delete records. The root cause is a purge_appointme...