CVE-2026-7493
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress up to version 1.6.11.5 is vulnerable to DoS. A publicly accessible REST API endpoint (/wp-json/ssa/v1/async) calls PHP's sleep() with a user-supplied delay parameter without rate limiting, allowing unauthenticated attackers to exhaust PHP worker processes.
Risk Assessment
Risk of complete denial of service (DoS) for the WordPress site, preventing legitimate users from accessing it.
Recommendation
Update the Simply Schedule Appointments plugin to the latest version. Temporarily block access to the /wp-json/ssa/v1/async endpoint for unauthenticated users.
Other vulnerabilities in Simply Schedule Appointments
See all- CVE-2026-65508Critical
Unauthenticated SQL Injection vulnerability in Simply Schedule Appointments versions up to 1.6.12.10.
- CVE-2026-39493Critical
There is an unauthenticated SQL injection vulnerability in Simply Schedule Appointments versions up to 1.6.9.27.
- CVE-2026-65513High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Simply Schedule Appointments plugin up to version 1.6.12.10. An unauthenticated attacker can inject malicious scripts.
- CVE-2026-15254Medium
The Simply Schedule Appointments WordPress plugin before version 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users. This allows users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
- CVE-2026-16540High
The Simply Schedule Appointments WordPress plugin before version 1.6.12.6 does not restrict a bulk appointment operation to the requester's own records. Unauthenticated users can retrieve personal data of all appointments and, on premium editions, permanently delete them.
- CVE-2026-13400Medium
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.
- CVE-2026-59523Medium
The Simply Schedule Appointments WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.6.11.11.
- CVE-2026-57812Medium
The Simply Schedule Appointments WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 1.6.12.4.
- CVE-2026-57317High
The vulnerability allows an unauthenticated attacker to execute XSS scripts in the Simply Schedule Appointments plugin versions up to and including 1.6.12.2.
- CVE-2026-42384High
The Simply Schedule Appointments application versions below 1.6.11.2 have a vulnerability that allows unauthorized access to sensitive data.
Original NVD description (English source)
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.