What is the CVSS score of CVE-2026-17023?

CVE-2026-17023 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-17023?

Yes, a public proof-of-concept exploit is available for CVE-2026-17023. Prioritise patching immediately. EPSS: 0.1%.

Salon Booking System CVE-2026-17023

EUVD-2026-55004 MEDIUM

Improper Access Control (CWE-284)

2026-08-10 WPScan

GHSA-3hmc-2cg9-g3wx

Google Authentication Bypass WordPress Salon Booking System

4.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.6 MEDIUM

AC:H for mandatory non-default Google OAuth configuration; C:L added because hijacked integration exposes future booking appointment data to attacker's account.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:48 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

4.8 (MEDIUM)

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

MEDIUM 4.8

DescriptionCVE.org

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

AnalysisAI

OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify target site running plugin with Google OAuth configured

Delivery

Send unauthenticated HTTP request to OAuth callback endpoint with attacker-controlled tokens

Exploit

Plugin accepts callback without state validation or capability check

Execution

Attacker tokens overwrite legitimate Google Calendar credentials in database

Impact

Future booking appointments sync to attacker's Google Calendar account

Access

Identify target site running plugin with Google OAuth configured

Delivery

Send unauthenticated HTTP request to OAuth callback endpoint with attacker-controlled tokens

Exploit

Plugin accepts callback without state validation or capability check

Execution

Attacker tokens overwrite legitimate Google Calendar credentials in database

Impact

Future booking appointments sync to attacker's Google Calendar account

Vulnerability AssessmentAI

Exploitation	Exploitation requires two concrete conditions to be simultaneously true: (1) the target WordPress site must have the Salon Booking System plugin's Google Calendar feature configured with the site's own Google OAuth client credentials (Client ID and Client Secret entered in plugin settings) - this is explicitly non-default and requires deliberate administrator action to set up; and (2) the attacker must be able to reach the WordPress site's OAuth callback URL over the network (standard internet access for public sites). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L correctly encodes the high attack complexity (AC:H) caused by the prerequisite that the target site must have its own Google OAuth client configured - a non-default setup. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker scans for WordPress sites running Salon Booking System and identifies one with Google Calendar configured via its own OAuth client (detectable via exposed plugin metadata or calendar-related public-facing UI elements). The attacker submits a crafted HTTP GET or POST request to the plugin's OAuth callback endpoint, supplying an authorization code or token from an attacker-controlled Google account, without any session cookie or nonce. …
Remediation	No vendor-released patch has been identified at time of analysis - the affected range listed by WPScan and EUVD-2026-55004 covers all versions through 10.30.33, with no fixed version specified. … Detailed patch versions, workarounds, and compensating controls in full report.