CVE-2026-17022 in Salon Booking System Plugin
Summary
by MITRE • 08/10/2026
The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The Salon Booking System WordPress plugin version 10.30.33 and earlier contains a critical authorization flaw that enables unauthenticated attackers to access sensitive customer booking data through improper input validation. This vulnerability resides in the booking-wizard confirmation process where the system fails to adequately verify ownership tokens before retrieving and displaying booking records. The flaw allows attackers to exploit sequential booking identifiers to enumerate and disclose confidential information belonging to other customers, creating a significant privacy and security risk for businesses using this plugin.
The technical implementation of this vulnerability stems from insufficient access control mechanisms within the plugin's confirmation workflow. When a user attempts to access a booking confirmation step, the system should validate that the requesting entity has legitimate authorization to view the specific booking record. However, the plugin's code does not properly authenticate or authorize requests based on ownership tokens, instead relying solely on sequential identifiers that can be easily guessed or enumerated by attackers. This design flaw creates a path for unauthorized data disclosure where attackers can systematically access booking records by incrementing booking ID values.
The operational impact of this vulnerability extends beyond simple information disclosure, as it exposes sensitive customer personal information including names, contact details, booking times, service selections, and potentially payment information depending on the plugin's configuration. Attackers can leverage this vulnerability to conduct targeted data scraping operations against businesses using the plugin, potentially enabling identity theft, social engineering attacks, or competitive intelligence gathering. The sequential nature of booking identifiers makes this attack vector particularly effective as it requires minimal technical expertise to exploit, allowing even novice attackers to systematically access multiple customer records.
From a cybersecurity perspective, this vulnerability aligns with CWE-285 (Improper Authorization) and represents a classic case of insufficient access control validation in web applications. The flaw also maps to ATT&CK technique T1213.002 (Data from Information Repositories) as it allows unauthorized access to stored customer data through repository enumeration techniques. Organizations using this plugin face potential regulatory compliance violations under data protection frameworks such as gdpr and ccpa, as unauthorized disclosure of personal information constitutes serious privacy breaches. The vulnerability's persistence across multiple versions indicates a fundamental flaw in the plugin's security architecture that requires immediate remediation.
Security mitigations for this vulnerability should include implementing proper ownership token validation before loading booking records, enforcing strict access controls on all confirmation steps, and implementing rate limiting to prevent systematic enumeration attacks. Plugin developers must ensure that each booking request includes authenticated ownership verification before any sensitive data is returned, while also implementing proper input sanitization and validation mechanisms. Organizations should immediately update to the latest plugin version where this vulnerability has been addressed, implement network monitoring to detect suspicious access patterns, and conduct comprehensive security assessments of all third-party plugins in their WordPress environments to identify similar authorization flaws that could expose customer data.