WordPress Simply Schedule Appointments Plugin Unauthenticated DoS Vulnerability (CVE-2026-7493)

Vulnerability Overview Vulnerability Name: Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service CVE ID: CVE-2026-7493 CVSS Score: 5.3 (Medium) Publication Date: May 26, 2026 Last Updated: May 27, 2026 Researchers: lucky_buddy Impact Scope Software Type: Plugin Software Slug: simply-schedule-appointments Affected Versions: <= 1.6.11.5 Fixed Version: 1.6.11.7 Remediation Remediation Advice: Update to version 1.6.11.7 or a newer patched version. Vulnerability Description This vulnerability allows an unauthenticated attacker to exhaust PHP worker processes by invoking a user-supplied delay parameter without rate limiting, resulting in a denial of service. References plugins.trac.wordpress.org Additional Information Recently Discovered Vulnerabilities: - CVE-2026-6937: Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint - CVE-2026-7797: Unauthenticated SQL Injection via append_where_sgf Parameter - CVE-2026-4807: Unauthenticated Arbitrary Appointment View, Modification and Deletion - CVE-2026-42384: Unauthenticated Sensitive Information Exposure - CVE-2026-39493: Unauthenticated SQL Injection - CVE-2026-39495: Authenticated (Contributor) SQL Injection - CVE-2026-3658: Unauthenticated SQL Injection via fields Parameter - CVE-2026-3045: Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint - CVE-2026-1704: Unauthenticated Direct Object Reference to Authenticated (Staff) Sensitive Information Exposure - CVE-2026-1708: Unauthenticated SQL Injection via append_where_sgf Parameter Notes This vulnerability database is completely free for both personal and commercial use, containing the same data as the Wordfence Intelligence user interface. API documentation and Webhook integrations are provided to obtain the latest vulnerability information in real-time. Contact Information Technical Support: 24-hour support, 365 days a year, with a 1-hour response time. Contact Email: support@wordfence.com Legal Disclaimer Content is copyrighted; see terms at the bottom of the page. Other Information Business Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays). Social Media: Facebook, Twitter, LinkedIn, Email Footer Information Products: Wordfence Free, Premium, Care, Response, CLI, Intelligence, Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE-Request Form Subscribe: Enter your email to subscribe to news and updates. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Disclaimer: Page content may contain errors; if found, please contact support@wordfence.com. Summary This page provides a detailed description of an unauthenticated denial-of-service vulnerability in the Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin, including specific vulnerability details, impact scope, remediation steps, reference links, and a list of recently discovered vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Simply Schedule Appointments Plugin Unauthenticated DoS Vulnerability (CVE-2026-7493)

More from this source