UNKNOWN NVD

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the reques

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

References

https://wpscan.com/vulnerability/8172f778-5dc5-49e8-9967-81215ac187d7/

Published: 2026-08-15 · Source: NVD · Feed updated: 2026-08-15

This unknown severity vulnerability was published on 2026-08-15 via NVD.

vulnfeed aggregates 11655 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.