CVE-2026-17020 in Salon Booking System Plugin
Summary
by MITRE • 08/10/2026
The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The Salon Booking System WordPress plugin version 10.30.33 contains a critical authorization vulnerability that undermines the security of customer data through its REST API implementation. This flaw represents a classic access control bypass where the plugin fails to validate ownership of booking records during API requests, allowing unauthorized enumeration of sensitive customer information. The vulnerability specifically affects endpoints that handle booking data retrieval and operates under the assumption that basic read capabilities are sufficient for accessing all booking records regardless of their actual owner.
The technical implementation flaw stems from insufficient input validation and authorization checks within the plugin's REST API framework. When authenticated users make requests to specific endpoints, the system does not perform proper ownership verification before returning booking details. This allows any authenticated user account, including low-privilege subscribers or self-registered customer accounts, to iterate through booking identifiers and extract personal information from other customers' reservations. The vulnerability operates at the application layer and specifically targets the plugin's API endpoints designed for booking management.
The operational impact of this vulnerability is severe as it enables unauthorized data disclosure that violates privacy regulations and customer trust. Attackers can systematically enumerate booking IDs to access comprehensive customer profiles including names, email addresses, phone numbers, physical addresses, and private notes associated with appointments. This creates a significant risk for businesses operating in regulated environments where personal data protection is mandatory, potentially leading to compliance violations under gdpr, ccpa, or other privacy frameworks. The breach affects not only individual customer privacy but also organizational reputation and potential legal liability.
This vulnerability aligns with CWE-639 Access Control Bypass Through User-Controlled Key and maps to ATT&CK technique T1213 Data from Information Repositories, specifically targeting credential access and data extraction phases. The flaw demonstrates a failure in proper authorization enforcement where the system assumes that authenticated access automatically grants universal data access rights. Organizations should implement immediate mitigations including patching to the latest plugin version, implementing additional API rate limiting, and enforcing proper access controls through custom code modifications or security plugins.
The security implications extend beyond simple information disclosure as this vulnerability enables potential secondary attacks such as social engineering, identity theft, or targeted phishing campaigns using the stolen personal data. System administrators should conduct immediate audits of all installed plugins to identify similar authorization flaws and implement comprehensive monitoring for unauthorized API access patterns. Regular security assessments and penetration testing should be performed to detect analogous issues in other WordPress plugins or custom applications that may exhibit similar access control weaknesses through REST API implementations, ensuring proper principle of least privilege enforcement across all application components.