CVE-2026-17021 in Salon Booking System Plugin

Summary

by MITRE • 08/10/2026

The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsible: WPScan
• Reservation: 07/24/2026
• Disclosure: 08/10/2026
• Moderation: accepted
• Entry: VDB-387323
• CPE: ready
• CWE: CWE-862 (confirmed)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-17021
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17021
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-17021/