CVE-2026-17022
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Salon Booking System WordPress plugin before version 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps. This allows unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Risk Assessment
Risk of customer privacy breach and personal data leakage, potentially leading to GDPR violations and loss of trust.
Recommendation
Update the Salon Booking System plugin to version 10.30.34 or later, which includes the token validation fix.
Other vulnerabilities in Salon Booking System
See all- CVE-2026-40768High
The salon booking system versions up to 10.30.24 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
- CVE-2026-66453Critical
The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.
- CVE-2026-17023Medium
The Salon Booking System WordPress plugin through version 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users. This allows an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
- CVE-2026-17021Medium
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
- CVE-2026-17020Medium
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
- CVE-2026-11887Medium
The Salon Booking System WordPress plugin before version 10.30.20 lacks proper authorization checks on one of its AJAX actions, allowing any authenticated user (e.g., a subscriber) to modify a plugin setting and bypass manual approval of new bookings.
- CVE-2026-42666High
The salon booking system versions up to 10.30.25 have an unauthenticated broken access control vulnerability that may allow unauthorized users to access resources.
Original NVD description (English source)
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.