Local File Inclusion Vulnerability in Simply Schedule Appointments Plugin for WordPress

CVE-2026-89294

What is CVE-2026-89294?

The Simply Schedule Appointments plugin for WordPress is susceptible to Local File Inclusion due to improper handling of the 'ssa_locale' parameter. This vulnerability affects all versions up to and including 1.6.12.27, allowing authenticated users with subscriber-level access to exploit the issue. Attackers can include and execute arbitrary PHP files on the server, potentially bypassing access controls to access sensitive information or run malicious code. The lack of a nonce or capability check during request handling exacerbates the risk, as these conditions are not enforced, enabling exploitation without proper authentication.

References