CVE-2026-7493

Vulnerability

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress contains a publicly accessible REST API endpoint at /wp-json/ssa/v1/async that accepts a user-supplied delay parameter. The endpoint calls PHP's sleep() function with this value without any rate limiting or authentication checks. This affects all versions up to and including 1.6.11.5. The vulnerable code is present in the class-async-action-model.php file [1].

Exploitation

An unauthenticated attacker can send repeated HTTP requests to the /wp-json/ssa/v1/async endpoint, specifying a large delay value. Each request causes the PHP worker process to sleep for the specified duration, tying up the worker. By sending many concurrent requests, the attacker can exhaust all available PHP worker processes, preventing the server from handling legitimate requests.

Impact

Successful exploitation results in a denial of service (DoS) condition. Legitimate users are unable to access the WordPress site because PHP workers are occupied by the sleeping requests. No data is compromised, but availability is severely impacted.

Mitigation

As of the publication date (2026-05-27), no fixed version has been released. The vendor has not disclosed a patch or workaround in the available references. Site administrators should consider disabling the REST endpoint via a firewall or web server rule, or implementing rate limiting on the /wp-json/ssa/v1/async path until an official update is provided.