CVE-2026-89294: Simply Schedule Appointments RCE Vulnerability

CVE-2026-89294 Overview

The Simply Schedule Appointments plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 1.6.12.27. Attackers exploit the ssa_locale parameter to include and execute arbitrary .php files on the server. The plugin registers the locale filter unconditionally during plugins_loaded, and the callback returns the raw GET parameter without nonce validation or capability checks. Successful exploitation lets attackers bypass access controls, read sensitive files, and achieve arbitrary PHP code execution when uploadable .php files are combined with this inclusion primitive.

Critical Impact

Attackers can include and execute arbitrary local .php files, leading to authentication bypass, data disclosure, and remote code execution.

Affected Products

• Simply Schedule Appointments plugin for WordPress
• All versions up to and including 1.6.12.27
• Vulnerable file: includes/class-translation.php

Discovery Timeline

• 2026-09-30 - CVE-2026-89294 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-89294

Vulnerability Analysis

The vulnerability resides in the plugin's translation handling logic in includes/class-translation.php. The ssa_locale GET parameter is passed into a WordPress locale filter callback that was hooked during plugins_loaded. The callback returns the raw parameter value without input validation, sanitization, or path normalization.

WordPress later uses that value to compute a translation file path, which the plugin then includes. Because the value flows into a file include operation, an attacker can traverse the filesystem and cause inclusion of arbitrary .php files ([CWE-98]). When combined with any writable directory that permits .php uploads, this yields remote code execution.

The description confirms the filter installs on every request, and the callback performs no nonce or capability check. This makes exploitation practical without authentication, despite the CVSS vector indicating low-privilege prerequisites.

Root Cause

The root cause is improper control of a filename used in a PHP include statement ([CWE-98]). User-controlled input from $_GET['ssa_locale'] reaches an include path without allow-list validation against known locale identifiers.

Attack Vector

An attacker sends an HTTP request to any endpoint served by the WordPress site with a crafted ssa_locale query parameter. The locale filter callback returns the attacker-controlled string, which is then used to resolve and include a .php file on the server. The technique enables inclusion of legitimate PHP files for control-flow abuse or uploaded PHP files for direct code execution.

No verified public proof-of-concept code is available. Technical details of the affected code paths are documented in the plugin source at lines 50, 67, and 108 of class-translation.php, referenced in the Wordfence Vulnerability Report and WordPress plugin source browser.

Detection Methods for CVE-2026-89294

Indicators of Compromise

• HTTP requests containing the ssa_locale GET parameter with path traversal sequences such as ../ or absolute file paths.
• Web server access logs showing repeated requests to WordPress endpoints with unusual ssa_locale values referencing non-locale filenames.
• Unexpected PHP files appearing in wp-content/uploads/ or other writable directories.
• Outbound network connections initiated by the PHP worker process after suspicious locale requests.

Detection Strategies

• Inspect access logs for ssa_locale= parameter values that do not match the pattern of standard locale codes such as en_US or fr_FR.
• Deploy Web Application Firewall (WAF) rules that block traversal characters and .php extensions in the ssa_locale parameter.
• Monitor PHP include, require, and file_get_contents calls originating from the plugin's translation class for anomalous paths.

Monitoring Recommendations

• Enable file integrity monitoring on the WordPress webroot and wp-content/plugins/simply-schedule-appointments/ directory.
• Alert on new or modified .php files in upload directories.
• Correlate WordPress authentication events with anomalous requests carrying the ssa_locale parameter.

How to Mitigate CVE-2026-89294

Immediate Actions Required

• Update the Simply Schedule Appointments plugin to a version later than 1.6.12.27 as soon as the vendor publishes a fix.
• If no patched version is available, deactivate and remove the plugin from affected WordPress sites.
• Audit wp-content/uploads/ and other writable directories for unauthorized .php files.
• Rotate WordPress administrator credentials and API keys if exploitation is suspected.

Patch Information

Refer to the Wordfence Vulnerability Report for the current patch status. Review the vulnerable code paths in the plugin source at line 50, line 67, and line 108.

Workarounds

• Block requests containing the ssa_locale query parameter at the WAF or reverse proxy layer until a patch is applied.
• Restrict PHP execution in wp-content/uploads/ using web server configuration to prevent inclusion of uploaded PHP payloads.
• Enforce PHP open_basedir restrictions to limit file inclusion to the WordPress installation directory.
• Disable file uploads for low-privilege roles including subscribers on sites where the plugin cannot be immediately removed.

# Example nginx rule to block traversal in ssa_locale parameter
if ($args ~* "ssa_locale=[^&]*(\.\.|/|\\)") {
    return 403;
}