CVE-2026-7493

5.3 Moyenne

Publiée le 27/05/2026 à 04:16 · Modifiée le 23/07/2026 à 13:10 · Analyse NVD reportée · Source : security@wordfence.com

Description

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.

Traduire en français

Produits concernés

croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-400

Références

https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.2/includes/class-async-action-model.php#L173
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66228e-d086-44fd-8acb-5a99482cedfb?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories