CVE-2026-11887
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Salon Booking System WordPress plugin before version 10.30.20 lacks proper authorization checks on one of its AJAX actions, allowing any authenticated user (e.g., a subscriber) to modify a plugin setting and bypass manual approval of new bookings.
Risk Assessment
The risk is that an unauthorized user can change plugin settings, potentially accepting fake or unwanted bookings without administrator consent, disrupting salon operations.
Recommendation
It is recommended to immediately update the Salon Booking System plugin to version 10.30.20 or later, which includes the necessary authorization fixes.
Other vulnerabilities in Salon Booking System
See all- CVE-2026-40768High
The salon booking system versions up to 10.30.24 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
- CVE-2026-66453Critical
The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.
- CVE-2026-17023Medium
The Salon Booking System WordPress plugin through version 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users. This allows an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
- CVE-2026-17022High
The Salon Booking System WordPress plugin before version 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps. This allows unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
- CVE-2026-17021Medium
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
- CVE-2026-17020Medium
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
- CVE-2026-42666High
The salon booking system versions up to 10.30.25 have an unauthenticated broken access control vulnerability that may allow unauthorized users to access resources.
Original NVD description (English source)
The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.