CVE-2026-16540: 
WordPress vulnerability analysis and mitigation

CVE-2026-16540 is an Incorrect Authorization vulnerability in the Simply Schedule Appointments WordPress plugin that allows unauthenticated users to retrieve personal data from all appointments across a site and, on premium editions, permanently delete all appointment records via an unrestricted bulk purge endpoint. It affects all versions of the plugin before 1.6.12.6, developed by NSquared. The vulnerability was publicly disclosed on July 22, 2026, with the CVE formally published on August 2, 2026. WPScan assigned a CVSS score of 6.5 (Medium), while Feedly's estimate categorizes it as High severity (WPScan, Github Advisory).

The root cause is an Incorrect Authorization flaw (CWE-863 / OWASP A5: Broken Access Control) in the plugin's bulk appointment purge endpoint, which fails to verify that the requesting user owns the records being operated on — or that the user is authenticated at all. An unauthenticated attacker can send crafted HTTP requests to this endpoint to enumerate and retrieve personal data (names, contact details, appointment metadata) for all bookings site-wide, and on premium plugin editions, trigger mass permanent deletion of appointment records. No authentication or special privileges are required to exploit this vulnerability (WPScan). The original researcher is Suleyman Huseynov (Twitter: huseyn0vs__), who also submitted the vulnerability to WPScan.

Successful exploitation allows an unauthenticated remote attacker to exfiltrate personal data (PII) from all appointment records stored by the plugin, posing significant privacy and regulatory compliance risks (e.g., GDPR). On sites running premium editions of the plugin, an attacker can also permanently destroy all appointment data, causing severe availability and business continuity impact. There is no lateral movement risk inherent to this vulnerability, but exposed PII could be leveraged in follow-on social engineering or phishing attacks (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the Simply Schedule Appointments plugin (versions before 1.6.12.6) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/simply-schedule-appointments/readme.txt.
2. Locate the vulnerable endpoint: Identify the plugin's bulk purge REST API or AJAX endpoint — typically accessible via WordPress's standard REST API or admin-ajax.php interface without authentication.
3. Send unauthenticated bulk request: Craft an HTTP POST or GET request to the purge endpoint without any authentication credentials or nonce validation, targeting all appointment records rather than a specific user's own records.
4. Retrieve appointment data: Parse the response to extract personal data (names, email addresses, phone numbers, appointment times) for all bookings across the site.
5. Mass deletion (premium editions): On sites running premium plugin editions, send the same or a similar unauthenticated request to trigger permanent deletion of all appointment records, causing irreversible data loss (WPScan).

• Network: Unusual unauthenticated HTTP requests to WordPress REST API endpoints or admin-ajax.php associated with the Simply Schedule Appointments plugin's purge or bulk operation actions; high-volume or repeated requests from a single IP to these endpoints.
• Logs: WordPress access logs showing requests to appointment-related endpoints (e.g., /wp-json/ssa/v1/ or action=ssa_*) without authentication headers or valid nonces; sudden bulk retrieval or deletion events in plugin activity logs.
• File System: No direct file system artifacts expected, but review plugin logs or any custom logging for mass appointment record access or deletion events.
• Application: Sudden disappearance of all appointment records in the Simply Schedule Appointments dashboard (indicative of mass deletion on premium editions); unexpected data exports or access patterns in appointment data (WPScan).

The vendor (NSquared) has released a patched version: Simply Schedule Appointments 1.6.12.6. All site administrators should update the plugin to this version or later immediately via the WordPress plugin dashboard. If immediate patching is not feasible, consider temporarily deactivating the plugin or restricting public access to the WordPress installation (e.g., via IP allowlisting or a WAF rule blocking unauthenticated requests to the plugin's bulk endpoints) until the update can be applied (WPScan, Github Advisory).

The vulnerability was discovered and responsibly disclosed by security researcher Suleyman Huseynov (Twitter: @huseyn0vs__), who submitted it to WPScan. A CVEnew Twitter/Nitter post was observed shortly after publication, indicating standard community notification. No major vendor statements beyond the WPScan advisory or significant media coverage have been identified at this time (WPScan).