The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin is vulnerable to denial of service in all versions up to and including 1.6.11.5. An unauthenticated attacker can trigger the publicly accessible REST API endpoint /wp-json/ssa/v1/async, which passes a user‑supplied delay parameter directly to PHP's sleep() function. Because the endpoint lacks rate limiting, an attacker can repeatedly invoke it to exhaust PHP worker processes, forcing the website to become unavailable to legitimate users. The weakness is a classic resource exhaustion flaw identified as CWE‑400.

Any WordPress installation running the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin version 1.6.11.5 or earlier. The plugin is distributed under the croixhaug vendor namespace. No specific environment or configuration is required for exploitation; the endpoint is publicly reachable.

The CVSS score of 5.3 places the vulnerability in the medium severity range. It is not listed in the CISA KEV catalog and its EPSS score is not available, indicating no current data on exploit probability. The attack vector is likely network‑based, because the endpoint is exposed to all visitors. An attacker needs no credentials and no special privileges; the vulnerability can be abused by simply sending repeated HTTP requests to the API, making the issue highly actionable and easy to exploit.