CVE-2026-7493: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin"to a version that resolves this vulnerability.Fixed in 1.6.11.5 - Compensating control
Add rate limiting/WAF rules for the publicly accessible REST API endpoint /wp-json/ssa/v1/async to prevent unauthenticated requests from exhausting PHP worker processes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7493?
The severity of CVE-2026-7493 is classified as medium with a score of 5.3.
What type of vulnerability is CVE-2026-7493?
CVE-2026-7493 is an unauthenticated denial of service vulnerability.
How do I fix CVE-2026-7493?
To fix CVE-2026-7493, update the Simply Schedule Appointments Booking Plugin to a version beyond 1.6.11.5.
What impact does CVE-2026-7493 have on my website?
CVE-2026-7493 allows an attacker to exploit an unauthenticated endpoint, potentially leading to denial of service for your website.
Which software is affected by CVE-2026-7493?
The vulnerability CVE-2026-7493 affects the Simply Schedule Appointments Booking Plugin for WordPress.