CVE-2026-16540

7.5 Élevée

Publiée le 02/08/2026 à 08:16 · Modifiée le 26/08/2026 à 18:31 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

Traduire en français

Produits concernés

Unknown Simply Schedule Appointments

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-863

Références

https://wpscan.com/vulnerability/c3829294-c388-4151-9e25-a3eac7b1f1c6/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories