CVE-2026-7493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.
| CWE | CWE-400 |
| Vendor | croixhaug |
| Product | appointment booking calendar — simply schedule appointments booking plugin |
| Published | May 27, 2026 |
| Last Updated | May 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for croixhaug appointment booking calendar — simply schedule appointments booking plugin
Be the first to know when new medium vulnerabilities affecting croixhaug appointment booking calendar — simply schedule appointments booking plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
croixhaug / Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
0 ≤ 1.6.11.5
References
Credits
lucky_buddy