Access Control Flaw in Simply Schedule Appointments Plugin for WordPress
CVE-2026-15254

Currently unrated

Key Information:

Vendor

WordPress
Status
Simply Schedule Appointments
Vendor
CVE Published:
3 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15254?

The Simply Schedule Appointments plugin for WordPress contains a significant access control issue. The plugin fails to implement proper capability checks on an administrative appointment-listing shortcode, which allows users with roles of Contributor or higher to access and disclose sensitive appointment records. This misconfiguration permits unauthorized viewing of all customer data, including names, email addresses, phone numbers, and appointment notes, impacting the overall security and privacy of user information across the site.

Affected Version(s)

Simply Schedule Appointments 0 < 1.6.12.11

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15254 - Proof of Concept

References

https://wpscan.com/vulnerability/551554a8-12fb-4eb5-bd24-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Meher Sudhakar Abbireddi
WPScan
.