CVE-2026-17023 in Salon Booking System Plugin
Summary
by MITRE • 08/10/2026
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The Salon Booking System WordPress plugin version 10.30.33 contains a critical authorization vulnerability that stems from inadequate input validation and missing capability checks within its Google Calendar integration workflow. This flaw exists in the OAuth callback endpoint that handles authentication responses from Google's OAuth service, creating an exploitable pathway for unauthenticated attackers to manipulate the plugin's stored credentials. The vulnerability specifically affects systems where administrators have configured their own Google OAuth client credentials for calendar synchronization purposes, making it a targeted issue rather than a universal threat across all installations.
The technical implementation of this flaw involves the plugin's failure to validate the OAuth state parameter that Google includes in authentication responses as a security measure to prevent cross-site request forgery attacks. Additionally, the plugin lacks proper capability checks that should verify whether the requesting user possesses sufficient privileges to modify calendar integration settings. The callback endpoint is incorrectly configured to accept requests from unauthenticated users, which violates fundamental security principles of least privilege and access control. This misconfiguration allows attackers to submit malicious OAuth responses that contain attacker-controlled tokens, effectively enabling them to hijack the legitimate Google Calendar connection.
The operational impact of this vulnerability is severe as it provides attackers with unauthorized access to calendar data and the ability to perform actions through the compromised integration. Once successful, an attacker can gain read and write access to all calendar events, potentially leading to data exfiltration, manipulation of scheduling information, or even disruption of business operations that depend on accurate calendar management. The hijacking of calendar tokens also means that any automated processes or notifications that rely on the legitimate connection could be compromised, creating additional attack vectors for further exploitation.
Security mitigations for this vulnerability should focus on implementing proper input validation and capability checks within the plugin's OAuth callback handler. The implementation must validate the OAuth state parameter against a stored nonce value to prevent CSRF attacks, while also ensuring that all requests to modify integration settings require appropriate authentication and authorization. Additionally, the callback endpoint should be configured to only accept authenticated requests or implement robust verification mechanisms before accepting any credential updates. This vulnerability aligns with CWE-352 Cross-Site Request Forgery and CWE-284 Improper Access Control, and maps to ATT&CK technique T1078 Valid Accounts for maintaining persistent access through compromised authentication credentials. The issue demonstrates a classic failure in secure coding practices where authentication and authorization checks are insufficiently implemented, requiring immediate remediation to protect WordPress installations using this plugin from potential compromise.