CVE-2026-89294

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.28

Description The Simply Schedule Appointments plugin for WordPress contains a Local File Inclusion flaw. This issue occurs via the ssa locale parameter, allowing attackers to include and execute arbitrary .php files on the server. This can lead to the execution of PHP code, bypassing of access controls, or the theft of sensitive data, particularly when .php files can be uploaded. Although described as requiring subscriber-level access, exploitation is possible without authentication because the locale filter is installed on every request during plugins loaded and the callback lacks nonce or capability checks before returning the raw GET parameter value.

Recommendations Update the plugin to a version newer than 1.6.12.27. As a temporary mitigation, restrict or filter the use of the ssa locale parameter.