This vulnerability (CVE-2026-42384) in Simply Schedule Appointments involves CWE-201, which is the insertion of sensitive information into sent data. It affects versions before 1.6.11.2 and allows unauthenticated remote attackers to gain access to sensitive information, leading to a confidentiality breach. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no official remediation or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability results in unauthorized disclosure of sensitive data without requiring authentication, which compromises confidentiality. There is no impact on integrity or availability. This could lead to exposure of sensitive user or system information handled by the Simply Schedule Appointments application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected application and minimizing exposure of sensitive data where possible.