CVE-2026-15254

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2026-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/551554a8-12fb-4eb5-bd24-ae627b58dc3b/

References

• CVE Record
• NVD entry

Related

• CVE-2026-15253
• CVE-2026-15255
• CVE-2026-15252
• CVE-2026-15256
• CVE-2026-15250
• CVE-2026-15257