Summary
CVE-2026-16540 is an Incorrect Authorization (CWE-863) vulnerability in the Simply Schedule Appointments WordPress plugin before version 1.6.12.6. The plugin fails to restrict a bulk appointment operation to the requester’s own records, allowing unauthenticated attackers to retrieve the personal data of every appointment on the site and, on premium editions, to permanently delete them. The issue is rated HIGH severity (CVSS 7.5).
Technical details
- Root cause: A bulk appointment operation exposed via the plugin’s REST endpoint does not properly enforce authorization, so it is not scoped to the requesting user’s own records.
- Trigger conditions: An attacker sends a request to the affected bulk/purge operation; no authentication or user interaction is required.
- Attack vector: Network — the vulnerable functionality is reachable over HTTP against an internet-facing WordPress site.
- Impact: Unauthenticated retrieval of personal data from all appointments across the site (confidentiality breach). On premium editions, the same flaw permits permanent deletion of appointment records.
Affected software
- Simply Schedule Appointments WordPress plugin — all versions before 1.6.12.6.
Severity
- CVSS v3.1 base score: 7.5 (HIGH)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Update the Simply Schedule Appointments plugin to version 1.6.12.6 or later.
- If no patch can be applied yet: Restrict access to the plugin’s REST API routes (
wp-json/ssa/v1) at the web server or WAF layer, and consider deactivating the plugin until it can be updated. Review appointment records for signs of unauthorized access or deletion.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
/wp-content/plugins/simply-schedule-appointments/,wp-json/ssa/v1

