CVE-2026-15254mediumCWE-863

CVE-2026-15254: medium-severity vulnerability in Simply Schedule Appointments

Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode

Published

Follow this CVE+ Monitor Simply Schedule Appointments

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.3%
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · Simply Schedule Appointments
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Simply Schedule Appointments

In the same product, most dangerous first.

CVE-2026-16540HIGHSimply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge EndpointEPSS 0.4%CVE-2026-16541MEDIUMSimply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST EndpointsEPSS 0.4%CVE-2026-13400MEDIUMSimply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer InformationEPSS 0.3%