Simply Schedule Appointments CVE-2026-16540

The vulnerability requires no authentication, no special privilege, and no non-default configuration - the WordPress REST API is enabled by default and the bulk appointment endpoint is reachable without credentials on any WordPress site with the plugin installed and active. The data disclosure (PII harvesting) impact applies to all editions of the plugin below 1.6.12.6. The additional permanent deletion impact is limited exclusively to premium-edition deployments. Exploitation is bounded by: (1) the site must have Simply Schedule Appointments installed and active, (2) the WordPress REST API must not be globally blocked at the network or application layer, and (3) the deletion capability requires the premium edition specifically. No user interaction, session, or configuration toggle is required to trigger data disclosure on the free edition.

The published CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) captures only the free-edition data disclosure impact; it materially understates risk for premium-edition deployments where unauthenticated permanent deletion raises effective impact to C:H/I:H/A:H. EPSS at 0.19% (9th percentile) indicates low near-term observed exploitation probability, creating an apparent conflict with POC availability - this likely reflects that exploitation has not yet been broadly automated or targeted at scale, not that the vulnerability is difficult to exploit. The SSVC automatable rating is the critical risk amplifier: bulk operations allow mass PII harvesting or record destruction in a single HTTP request, removing per-record friction entirely. Sites handling sensitive scheduling contexts (healthcare, legal, personal services) should treat this as high priority. KEV status is not confirmed; no active exploitation is evidenced beyond POC availability. The low EPSS should not be used as a reason to deprioritize patching given zero-prerequisite exploitation and an existing public exploit.

A publicly available proof-of-concept exists per WPScan. An unauthenticated attacker sends a single crafted HTTP request to the plugin's bulk appointment REST endpoint, receiving in response the full dataset of all appointments including visitor names, contact information, and scheduling details for every user on the site. On premium installations, the attacker substitutes a delete operation in the same unauthenticated request, permanently purging all appointment records and causing immediate business disruption with no rollback path.