Description
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.
Published: 2026-09-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

The vulnerability is a Local File Inclusion flaw that allows the plugin to include and execute arbitrary PHP files via the 'ssa_locale' GET parameter. This results in the ability to run attacker supplied code, bypass authorization controls, and access sensitive data. The flaw is classified as CWE-98, reflecting improper handling of user-controlled file paths.

Affected Systems

All versions of the Simply Schedule Appointments WordPress plugin up to and including 1.6.12.27, developed by croixhaug. Users of older or unpatched installations are impacted.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the flaw can be exploited remotely via crafted URL requests and does not require authenticated access despite the original description stating subscriber-level capability is needed. Once an attacker gains ability to trigger the inclusion, they can execute arbitrary PHP code on the web server.

Generated by OpenCVE AI on September 30, 2026 at 12:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Simply Schedule Appointments plugin to a version that removes or secures the 'ssa_locale' parameter handling
  • If an update is not immediately possible, apply a temporary workaround by disabling the locale filter or limiting access to the 'ssa_locale' parameter to authenticated administrator roles
  • Review server file permissions to ensure that user-uploaded PHP files cannot be executed from web-accessible directories

Generated by OpenCVE AI on September 30, 2026 at 12:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.
Title Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-30T15:28:11.776Z

Reserved: 2026-09-11T12:50:21.802Z

Link: CVE-2026-89294

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-30T07:16:30.947

Modified: 2026-09-30T16:19:22.380

Link: CVE-2026-89294

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T12:30:17Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')