CVE-2026-7493 is a denial of service vulnerability in the Simply Schedule Appointments Booking Plugin for WordPress. The vulnerability exists because the REST API endpoint /wp-json/ssa/v1/async calls PHP's sleep() function using a delay parameter supplied by the user without any rate limiting controls. This allows unauthenticated attackers to cause uncontrolled resource consumption by tying up PHP worker processes, resulting in denial of service conditions for legitimate users. The vulnerability affects all versions up to and including 1.6.11.5. There is no vendor advisory or patch information available at this time.

Exploitation of this vulnerability can lead to denial of service by exhausting PHP worker processes on the affected WordPress site. This prevents legitimate users from accessing the site or its booking functionality. There is no impact on confidentiality or integrity reported. The vulnerability is exploitable remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or firewall rules to restrict access to the vulnerable REST API endpoint to mitigate potential abuse.