CVE-2026-7493

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.2/includes/class-async-action-model.php#L173
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66228e-d086-44fd-8acb-5a99482cedfb?source=cve

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-27 02:16

Updated : 2026-07-23 11:10

NVD link : CVE-2026-7493

Mitre link : CVE-2026-7493

CVE.ORG link : CVE-2026-7493

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-7493", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7493", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T10:21:32.825685Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "croixhaug", "product": "Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.11.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-27T02:16:34.770", "references": [{"url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.2/includes/class-async-action-model.php#L173", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66228e-d086-44fd-8acb-5a99482cedfb?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users."}, {"lang": "es", "value": "El plugin Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin para WordPress es vulnerable a denegaci\u00f3n de servicio en todas las versiones hasta la 1.6.11.5, inclusive. Esto se debe a un endpoint de la API REST accesible p\u00fablicamente (/wp-json/ssa/v1/async) que llama a la funci\u00f3n sleep() de PHP sobre un par\u00e1metro de retardo proporcionado por el usuario sin ninguna limitaci\u00f3n de velocidad. Esto hace posible que atacantes no autenticados agoten los procesos de trabajador de PHP, negando el acceso al sitio a usuarios leg\u00edtimos."}], "lastModified": "2026-07-23T11:10:00.120", "sourceIdentifier": "security@wordfence.com"}