CVE-2026-89294 is a Local File Inclusion vulnerability in the Simply Schedule Appointments WordPress plugin (versions <=1.6.12.27). The flaw is due to improper control of the filename used in an include/require statement via the 'ssa_locale' parameter. The plugin installs a locale filter on every request during the plugins_loaded hook, which returns the raw GET parameter value without verifying user capabilities or nonces. This allows attackers, including unauthenticated ones in practice, to include arbitrary PHP files, leading to code execution and potential access control bypass.

Successful exploitation allows an attacker to execute arbitrary PHP code on the server by including malicious files. This can result in full compromise of the web application, unauthorized data access, and bypass of access controls. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, reflecting network attack vector, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin and consider disabling it if possible. Monitor for updates from the vendor and apply official patches promptly once released.