CVE-2026-16540: WordPress Plugin Information Disclosure

CVE-2026-16540 Overview

CVE-2026-16540 is a broken access control vulnerability in the Simply Schedule Appointments WordPress plugin before version 1.6.12.6. The plugin fails to restrict a bulk appointment operation to the records owned by the requester. Unauthenticated attackers can retrieve personal data from every appointment stored on the site. On premium editions, attackers can also permanently delete every appointment record. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Remote, unauthenticated attackers can exfiltrate all appointment personal data and, on premium editions, destroy the entire appointment dataset.

Affected Products

Simply Schedule Appointments WordPress plugin (free edition) before 1.6.12.6
Simply Schedule Appointments premium editions before 1.6.12.6
WordPress sites exposing the plugin's REST endpoints to the public internet

Discovery Timeline

2026-08-02 - CVE-2026-16540 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16540

Vulnerability Analysis

The Simply Schedule Appointments plugin exposes a bulk appointment operation that acts on multiple appointment records at once. The authorization logic for this operation does not verify that the caller owns the appointments being read or modified. As a result, an unauthenticated HTTP request can enumerate and return personal data across every appointment in the database. Personal data typically includes names, email addresses, phone numbers, and scheduled meeting details.

On premium editions of the plugin, the same bulk operation supports deletion. Because the authorization gap applies uniformly, an unauthenticated attacker can issue a destructive bulk request that removes all appointments from the site. Deleted records are permanently lost, which affects business continuity for organizations that rely on the plugin for customer scheduling.

Root Cause

The root cause is an authorization check that scopes to the operation type but not to record ownership. The handler accepts a list of appointment identifiers and processes each one without confirming that the caller has rights to that specific record. This pattern matches [CWE-863], where an authorization decision is made using incorrect logic.

Attack Vector

The attack is remote, requires no privileges, and requires no user interaction. An attacker sends a crafted HTTP request to the plugin's bulk appointment endpoint on any vulnerable WordPress site. The endpoint returns appointment records belonging to all users. For premium sites, the attacker substitutes the destructive verb of the same bulk operation to erase all appointments. Details are available in the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-16540

Indicators of Compromise

Unauthenticated requests to Simply Schedule Appointments REST routes referencing bulk appointment actions
Large outbound responses from the plugin endpoint to a single external IP address
Sudden loss of appointment records or mass state changes in the plugin's database tables
Access log entries showing enumeration of appointment IDs from unauthenticated sessions

Detection Strategies

Review web server access logs for requests to /wp-json/ssa/v1/ routes originating without an authenticated session cookie or nonce
Alert on HTTP responses from the plugin endpoint that return unusually large JSON payloads containing customer PII fields
Compare current appointment counts to historical baselines and flag sharp decreases

Monitoring Recommendations

Enable WordPress audit logging for REST API calls and database write operations on plugin tables
Forward web access logs and WordPress audit events to a central SIEM for correlation
Monitor for repeated 200-OK responses on unauthenticated plugin endpoints during short time windows

How to Mitigate CVE-2026-16540

Immediate Actions Required

Update the Simply Schedule Appointments plugin to version 1.6.12.6 or later on every WordPress site
Take a full database backup before applying the update to preserve current appointment data
Audit access logs for prior unauthenticated requests to the plugin's bulk endpoints and treat matches as data exposure incidents
Notify affected data subjects if evidence of appointment enumeration is found, in line with applicable privacy regulations

Patch Information

The vendor has released Simply Schedule Appointments 1.6.12.6, which enforces per-record ownership checks in the bulk appointment operation. Site owners should install the update through the WordPress plugin manager or via WP-CLI. Refer to the WPScan Vulnerability Advisory for advisory details.

Workarounds

Restrict access to /wp-json/ssa/* REST routes with a web application firewall rule that blocks unauthenticated requests
Temporarily deactivate the plugin on sites that cannot be patched immediately
Place the WordPress admin and REST API behind IP allowlisting until the update is applied

bash

# Update the plugin using WP-CLI
wp plugin update simply-schedule-appointments --version=1.6.12.6
wp plugin list | grep simply-schedule-appointments