EUVD-2026-59589
GHSA-9337-jrpr-pg7c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST API requires only staff-role credentials (PR:L); unrestricted user enumeration warrants C:H with zero integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
AnalysisAI
Unauthorized user enumeration in the Simply Schedule Appointments WordPress plugin before 1.6.12.17 allows authenticated staff-role users to retrieve names and email addresses of all registered users via insufficiently scoped REST API endpoints. The vulnerability stems from missing authorization checks that should limit returned user records to those the requester is permitted to view. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), indicating low exploitation probability, though the confidentiality impact is rated High due to unrestricted PII exposure.
Technical ContextAI
Simply Schedule Appointments is a WordPress scheduling plugin that exposes REST API endpoints for appointment and user management. The affected code paths fail to apply role-based scoping to query results, implementing CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Rather than filtering returned user records to those the requesting staff-role user is entitled to see, the endpoints return data for arbitrary registered WordPress accounts. The CVSS vector AV:N/PR:L confirms these are network-accessible endpoints requiring only low-privileged authentication, consistent with a REST API design where authorization enforcement is absent at the data layer. Affected versions span all releases from 0 up to (but not including) 1.6.12.17 per EUVD-2026-59589.
RemediationAI
Update Simply Schedule Appointments to version 1.6.12.17 or later, which introduces the missing authorization scoping on the affected REST endpoints. The vendor-released patch is confirmed available per WPScan advisory https://wpscan.com/vulnerability/8172f778-5dc5-49e8-9967-81215ac187d7/. As a compensating control prior to patching, restrict assignment of the staff role exclusively to fully trusted internal users, as any staff-role account can be leveraged for exploitation. WordPress administrators may also consider restricting REST API access at the web server or firewall level to internal networks only, though this may impair legitimate scheduling functionality and should be tested before deployment. There are no known significant side effects from applying the vendor patch.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today