CVE-2026-7493: WordPress SSA Plugin DoS Vulnerability

CVE-2026-7493 Overview

CVE-2026-7493 is a denial of service vulnerability in the Simply Schedule Appointments booking plugin for WordPress. The flaw affects all versions up to and including 1.6.11.5. The plugin exposes a publicly accessible REST API endpoint at /wp-json/ssa/v1/async that invokes PHP's sleep() function on a user-supplied delay parameter. The endpoint enforces no rate limiting and requires no authentication. Unauthenticated attackers can submit concurrent requests with high delay values to exhaust available PHP worker processes. Once workers are saturated, the WordPress site stops responding to legitimate visitors. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Unauthenticated attackers can render affected WordPress sites unavailable by saturating PHP worker processes through a single REST endpoint.

Affected Products

Simply Schedule Appointments Booking Plugin for WordPress, all versions up to and including 1.6.11.5
WordPress installations exposing the /wp-json/ssa/v1/async REST endpoint
Hosting environments with finite PHP-FPM or PHP worker pools serving the plugin

Discovery Timeline

2026-05-27 - CVE-2026-7493 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-7493

Vulnerability Analysis

The vulnerability resides in the plugin's async action handler. The plugin registers a REST route at /wp-json/ssa/v1/async that accepts requests without authentication. The handler passes a client-controlled delay value directly into PHP's sleep() call. Each request blocks one PHP worker for the requested duration.

PHP-FPM and similar process managers run a finite pool of workers. An attacker who issues a small number of concurrent requests with maximum delay values can occupy every worker simultaneously. Legitimate visitors then receive timeouts, 502 errors, or queue indefinitely until workers free up.

The attack requires no credentials, no user interaction, and produces effects only on availability. Confidentiality and integrity are not affected, which aligns with the published CVSS impact metrics.

Root Cause

The root cause is missing input validation and missing throttling on a state-changing primitive. The handler trusts a user-supplied delay parameter and forwards it to a blocking system call. The plugin does not cap the delay value, does not require authentication, and does not apply per-IP or per-session rate limiting on the endpoint.

Attack Vector

An attacker sends repeated unauthenticated HTTP requests to /wp-json/ssa/v1/async over the network. Each request supplies a high delay value. Concurrent requests consume the available PHP worker pool. Refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Analysis for the affected code path.

No verified public proof-of-concept code is referenced in the advisory data. The exploitation pattern is described in prose only.

Detection Methods for CVE-2026-7493

Indicators of Compromise

Repeated HTTP requests to /wp-json/ssa/v1/async from a small set of source addresses
Bursts of long-running PHP-FPM worker processes blocked on sleep() system calls
Sudden increase in PHP worker pool utilization without a matching increase in legitimate traffic
Web server returning 502, 503, or 504 responses while CPU usage remains low

Detection Strategies

Inspect access logs for unauthenticated requests to /wp-json/ssa/v1/async and group by source IP
Correlate PHP-FPM slow log entries with REST endpoint hits to the Simply Schedule Appointments plugin
Alert when concurrent active PHP workers approach the configured pm.max_children value
Compare request rates against historical baselines for the WordPress REST API

Monitoring Recommendations

Enable PHP-FPM status and slow log endpoints and forward metrics to a central monitoring system
Forward web server access logs to a SIEM and build queries for the affected REST path
Track availability of the WordPress site with synthetic monitoring to identify worker exhaustion early

How to Mitigate CVE-2026-7493

Immediate Actions Required

Update the Simply Schedule Appointments plugin to a version newer than 1.6.11.5 once a patched release is available
Block or rate limit requests to /wp-json/ssa/v1/async at the web server, CDN, or web application firewall layer
Restrict access to the WordPress REST API for unauthenticated users where business requirements allow

Patch Information

The advisory data lists affected versions up to and including 1.6.11.5. Administrators should consult the Wordfence Vulnerability Analysis and the plugin's WordPress.org listing for the fixed release version.

Workarounds

Deploy a web application firewall rule that drops requests to /wp-json/ssa/v1/async from unauthenticated clients
Apply per-IP rate limits in Nginx or Apache for the /wp-json/ssa/v1/async path
Reduce PHP-FPM request_terminate_timeout so blocked workers are reclaimed faster
Temporarily disable the plugin on sites that do not require active booking functionality

bash

# Nginx rate limit example for the vulnerable REST endpoint
limit_req_zone $binary_remote_addr zone=ssa_async:10m rate=2r/m;

location = /wp-json/ssa/v1/async {
    limit_req zone=ssa_async burst=2 nodelay;
    limit_req_status 429;
    proxy_pass http://php_backend;
}