Simply Schedule Appointments EUVD-2026-89654

Exploitation targets the 'ssa_locale' GET parameter handled by the translation/locale filter in class-translation.php, which per the description is registered unconditionally on every request during plugins_loaded with no nonce or capability check - so no authenticated session is genuinely required despite the PR:L rating, and default installations are affected without special configuration. The limiting factor is impact depth: including an already-present .php file executes that file (information disclosure / access-control bypass), but achieving execution of ATTACKER-supplied PHP additionally requires a way to place a .php file on the server (an upload feature or writable path), which is why the CVSS assigns AC:H. All versions of Simply Schedule Appointments up to and including 1.6.12.27 are affected.

This is a genuine high-priority issue rather than an inflated CVSS score. The provided CVSS 3.1 vector (7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) already reflects full C/I/A impact over the network, and the description escalates the concern: it explicitly states that exploitation 'does not require authentication in practice' because the locale filter is registered unconditionally during plugins_loaded and the callback performs no nonce or capability check before consuming the raw GET parameter. This directly conflicts with the vector's PR:L (subscriber-level) rating - the description implies PR:N should apply, which would raise real-world severity. The AC:H rating is defensible because achieving full remote code execution depends on an attacker-controllable .php file already existing on the server (e.g., via an upload path); pure Local File Inclusion of an existing .php file, however, needs no such precondition and yields code execution of that file plus information disclosure. No EPSS score, KEV listing, SSVC decision, or POC is provided in the input, so exploitation likelihood cannot be quantified from these signals - the reliance is on the code-level analysis by Wordfence, who linked the exact vulnerable source lines (class-translation.php L50/L67/L108). Net: treat as high priority for any site running this plugin, especially given the credible unauthenticated-in-practice claim.

A remote attacker sends a crafted HTTP request to a WordPress site running Simply Schedule Appointments (≤1.6.12.27) with a malicious 'ssa_locale' value that traverses to and includes an arbitrary .php file on the server. Because the locale filter is installed unconditionally on every request and performs no capability or nonce check, the include executes the targeted PHP, enabling disclosure of sensitive files or full code execution where an attacker-controlled .php (e.g., an uploaded avatar or media file) can be referenced. No public exploit code is identified in the provided data, though Wordfence has published the vulnerable source locations.