CVE-2026-16540 Simply Schedule CVE debrief

Who should care

Users of the Simply Schedule Appointments WordPress plugin, especially those with premium editions, should verify and update their plugin versions. Affected operators and security teams should review the vulnerability details and assess their exposure. Vulnerability management and platform security teams should prioritize updating the plugin to prevent unauthorized access to appointment data.

Technical summary

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them. This vulnerability allows unauthenticated access to sensitive appointment data and potential deletion of records on premium editions.

Defensive priority

Unauthenticated users can access and potentially delete appointment data; verify and restrict plugin access.

Recommended defensive actions

• Verify plugin version and update to 1.6.12.6 or later
• Restrict access to plugin functionality
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in Simply Schedule Appointments WordPress plugin versions before 1.6.12.6; verify installed version and check for updates. Evidence limits suggest focusing on version checks and update guidance. Defensive verification tasks include reviewing plugin version, checking for updates, and monitoring for suspicious activity related to appointment data access.

Official resources