CVE-2026-16541 Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints
Low-privileged staff users can access REST endpoints to disclose names and email addresses of arbitrary registered users in the Simply Schedule Appointments plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16541?
CVE-2026-16541 is a medium-severity missing authorization vulnerability in Unknown Simply Schedule Appointments, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
Weakness: CWE-200
Which versions are affected by CVE-2026-16541?
How do I fix CVE-2026-16541?
No fix has been published for CVE-2026-16541 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-16541 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-16541 exists.
Sources
Also known as GHSA-9337-jrpr-pg7c.