What is the CVSS score of CVE-2026-7493?

CVE-2026-7493 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Simply Schedule Appointments CVE-2026-7493

EUVD-2026-32036 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-27 security@wordfence.com

GHSA-599f-5f93-g6j8

Denial Of Service WordPress PHP

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:40 vuln.today

CVE Published

May 27, 2026 - 02:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.

AnalysisAI

Uncontrolled resource consumption in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.11.5) enables unauthenticated remote attackers to exhaust PHP-FPM or mod_php worker processes, effectively rendering the WordPress site unavailable to legitimate users. The attack surface is a publicly accessible REST endpoint (/wp-json/ssa/v1/async) that directly passes a caller-controlled delay parameter into PHP's native sleep() function with no rate limiting or input sanitization. No public exploit code has been identified at time of analysis and EPSS is very low (0.05%, 15th percentile), suggesting limited opportunistic interest so far, though the trivially low attack complexity means any actor can attempt this with no tooling.

Technical ContextAI

The vulnerability resides in the Simply Schedule Appointments WordPress plugin's asynchronous action handler, specifically class-async-action-model.php at line 173 (visible in plugin tag 1.6.11.2 on the WordPress Trac browser). The affected endpoint is /wp-json/ssa/v1/async, a REST route registered without authentication guards. It invokes PHP's sleep() built-in with a duration derived from user input, causing each request to hold a PHP worker process open for an attacker-controlled duration. Under typical WordPress deployments using PHP-FPM or Apache mod_php, the total number of concurrent worker processes is finite (often 5-20 by default). CWE-400 (Uncontrolled Resource Consumption) precisely describes this root cause: the application fails to constrain how much of a shared resource (PHP workers) a single caller can consume. The REST API is part of WordPress core infrastructure, meaning no special endpoint discovery is needed - /wp-json is enabled by default on all modern WordPress installations.

RemediationAI

Update the Simply Schedule Appointments plugin to a version released after 1.6.11.5, which is the last confirmed vulnerable release. No explicit patched version number was provided in the available intelligence data - confirm the current release version via the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66228e-d086-44fd-8acb-5a99482cedfb?source=cve before upgrading. As an immediate compensating control while awaiting a confirmed patched release, configure rate limiting on the /wp-json/ssa/v1/async URI path at the web server or WAF layer (e.g., nginx limit_req_zone or a WAF rule) to restrict concurrent and per-second requests per IP; this directly counters worker exhaustion without disabling the plugin, though it may throttle legitimate async scheduling actions for high-volume booking sites. Alternatively, if the async endpoint is not required for your booking workflow, blocking the route entirely at the web server level eliminates the attack surface with no functional side effect if the async feature is unused.