CVE-2026-17021
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Risk Assessment
Risk of unauthorized modification of booking data, potentially leading to data integrity compromise and fraud.
Recommendation
Upgrade the Salon Booking System plugin to version 10.30.34 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.