CVE-2026-16541 is an information exposure vulnerability in the Simply Schedule Appointments WordPress plugin prior to version 1.6.12.17. The plugin's REST API endpoints do not enforce proper access controls on user records, allowing low-privileged staff users to retrieve names and email addresses of arbitrary registered users. This exposure violates data confidentiality by disclosing sensitive user information to unauthorized roles. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation details are currently provided in the available data.

Unauthorized disclosure of registered users' names and email addresses can occur when exploited by low-privileged staff users. This information exposure could facilitate further social engineering or phishing attacks but does not impact integrity or availability. The vulnerability affects confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict staff user roles from accessing the vulnerable REST endpoints if possible, or limit plugin usage to trusted users. Monitor vendor channels for updates and apply patches promptly once released.