CVE-2026-89294: Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during pluginsloaded and the callback performs no nonce or capability check before returning the raw GET parameter value.
Affected Software
Event History
Frequently Asked Questions
Is authentication actually required to exploit this issue?
No. Although the issue is categorized as subscriber-level and above, the locale filter is installed on every request and returns the raw GET parameter without a nonce or capability check. In practice, an unauthenticated remote attacker can reach the vulnerable behavior.
What conditions are needed for code execution?
The issue can include and execute PHP files available on the server. Code execution is possible when an attacker can cause a PHP file to be uploaded or otherwise present at a path that can be included.
What could an attacker gain from successful exploitation?
An attacker may bypass access controls, access sensitive data, or execute PHP code from included files. The reported impact includes compromise of confidentiality, integrity, and availability.
Which installations are affected?
All Simply Schedule Appointments versions through 1.6.12.27 are affected. The vulnerable locale filter is installed unconditionally during the WordPress plugins_loaded phase.