What is the CVSS score of EUVD-2026-51951?

EUVD-2026-51951 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Simply Schedule Appointments are affected by EUVD-2026-51951?

Simply Schedule Appointments WordPress plugin versions before 1.6.12.6 contain an authorization bypass allowing unauthenticated attackers to access and download all appointment records…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51951?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51951. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-51951?

Within 24 hours: conduct a complete inventory of WordPress installations using Simply Schedule Appointments plugin and document all affected instances and current versions. Within 7 days: deploy Simply Schedule Appointments version 1.6.12.6 or later to all affected WordPress installations and verify successful patching. Within 30 days: review server access logs from the past 90 days for suspicious activity targeting appointment operations, audit appointment records for unauthorized access or deletion, and implement WAF rules to restrict bulk appointment endpoints from external network access.

Simply Schedule Appointments EUVD-2026-51951

| CVE-2026-16540 HIGH

Incorrect Authorization (CWE-863)

2026-08-02 WPScan

GHSA-j5pv-734r-xv95

WordPress Authentication Bypass Simply Schedule Appointments Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.8 CRITICAL

Premium editions allow unauthenticated permanent deletion of all records, adding I:H and A:H beyond the published free-edition-only score of C:H/I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:27 vuln.today

Patch available

Aug 02, 2026 - 07:00 EUVD

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

AnalysisAI

Simply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated users through a bulk operation endpoint lacking object-level authorization, enabling mass personal data (PII) disclosure across the entire WordPress installation. On premium editions, the same unauthenticated path allows permanent deletion of all appointment records, adding a destructive integrity and availability impact not reflected in the published CVSS score. A public proof-of-concept exists per WPScan, and the SSVC framework rates this as automatable with no active CISA KEV listing; EPSS at 0.19% suggests limited observed exploitation to date but does not negate the ease of scripted mass harvesting.

Technical ContextAI

The Simply Schedule Appointments plugin (CPE: cpe:2.3:a:unknown:simply_schedule_appointments:*:*:*:*:*:*:*:*) is a WordPress scheduling and booking plugin operating over the WordPress REST API. The root cause is CWE-863 (Incorrect Authorization): the plugin's bulk appointment operation endpoint processes requests against the full site-wide appointment dataset without verifying that the caller owns or is authorized to access those records. This is a Broken Object Level Authorization (BOLA/IDOR) pattern amplified to bulk scope - a single unauthenticated request returns or destroys the entire appointment table rather than requiring per-record exploitation. The REST API is enabled by default in WordPress, meaning no non-default configuration is required to reach the vulnerable endpoint. The CPE vendor field is listed as 'unknown' in NVD, indicating incomplete identifier resolution that may cause CPE-based vulnerability scanners to miss affected installations.

RemediationAI

The primary fix is to update Simply Schedule Appointments to version 1.6.12.6 or later via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or through the WordPress plugin repository; a vendor-released patch is confirmed available. Premium-edition deployments should be treated as highest urgency given the additional permanent-deletion risk. As a compensating control prior to patching, administrators can block unauthenticated access to the plugin's bulk appointment REST endpoint using a WAF rule targeting the relevant REST route - this is surgical and avoids breaking other REST-dependent site functionality. Alternatively, globally restricting unauthenticated WordPress REST API access via a plugin such as Disable REST API will block exploitation but may break other plugins or themes relying on public REST endpoints; weigh this trade-off before deploying. References: WPScan advisory at https://wpscan.com/vulnerability/c3829294-c388-4151-9e25-a3eac7b1f1c6/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-16540.