Salon Booking System CVE-2026-17020

Exploitation requires the attacker to hold at least a subscriber-level or self-registered customer WordPress account on the targeted site - unauthenticated exploitation is not possible per the CVSS PR:L metric. The Salon Booking System plugin must be installed and active, and the vulnerable REST API endpoint must be network-reachable. Sites that permit open public self-registration face significantly elevated risk because an attacker can trivially acquire the required authentication credential without any administrator involvement. Sites that restrict account creation to administrator-invited users substantially limit exposure, as the attacker must first compromise or socially engineer an existing account. No non-default plugin configuration or special deployment mode is required - the flaw is present in the default plugin installation.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the attack profile: network-reachable, low complexity, low-privilege authenticated access with confidentiality-only impact and unchanged scope. The EPSS score of 0.13% at the 3rd percentile is notably low, indicating the vulnerability has not been broadly observed in exploitation telemetry at time of analysis, which is consistent with the plugin's niche deployment footprint. However, the existence of a publicly available proof-of-concept from WPScan substantially reduces the technical barrier - any attacker who registers a free customer account on a target site can immediately weaponize this without needing deep expertise, meaning even a mid-sized salon franchise operator in sanok running an open-registration booking portal could inadvertently expose their entire customer PII database to a malicious registrant. The absence of a CISA KEV listing means confirmed in-the-wild campaigns have not been tracked, but this should not be mistaken for low urgency on sites with open self-registration enabled. Real-world priority is meaningfully elevated for operators where new accounts can be freely created.

An attacker registers a free customer account on a target salon's WordPress site, then uses the publicly available WPScan proof-of-concept to issue authenticated REST API calls with sequentially incremented booking identifiers. Without triggering any ownership check, the endpoint returns full booking records for all other customers, exposing names, email addresses, phone numbers, home addresses, and private appointment notes at scale.