Salon Booking System CVE-2026-17022

No special conditions are required beyond the target site having the Salon Booking System WordPress plugin installed and active in a version through 10.30.33. The booking-wizard confirmation endpoint is exposed by default as part of the plugin's standard installation; no optional feature toggle or non-default configuration is needed. CVSS confirms PR:N/UI:N/AV:N, meaning no authentication, no user interaction, and full network accessibility are required. The limiting factors are: (1) booking records only exist if customers have made bookings - sites with no bookings have no data to expose; (2) sequential ID enumeration requires the attacker to send multiple requests, which may trigger rate-limiting if the hosting environment enforces it; (3) exploitation is scoped to customer booking data only - it does not provide access to WordPress admin credentials or the broader site.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the attack surface: fully network-accessible, zero-complexity enumeration, requiring no authentication and no user interaction. However, the EPSS score of 0.14% (4th percentile) indicates that real-world automated exploitation has not been widely observed despite the publicly available WPScan proof-of-concept, suggesting opportunistic rather than mass-exploitation activity to date. The absence of a CISA KEV listing is consistent with this lower exploitation rate. That said, the trivially automatable nature of sequential ID enumeration means any operator running this plugin on a high-volume booking site faces a genuine bulk-PII risk - even a mid-sized appointment business in koszalin would expose its entire customer base to enumeration. Regulatory exposure under GDPR or equivalent frameworks elevates the business impact beyond what the CVSS confidentiality metric alone conveys. The low EPSS is not grounds for deprioritization - the POC lowers the barrier to exploitation significantly.

An unauthenticated attacker discovers a WordPress site running the Salon Booking System plugin and sends HTTP GET requests to the booking-wizard confirmation endpoint, incrementing the booking ID parameter from 1 upward. Each valid response returns a booking record containing the customer's name, contact details, and appointment information. A publicly available proof-of-concept (via WPScan) documents this exact approach, and the entire customer booking history of a site can be harvested with a simple script requiring no credentials or special tooling.