Salon Booking System CVE-2026-17023

Exploitation requires two concrete conditions to be simultaneously true: (1) the target WordPress site must have the Salon Booking System plugin's Google Calendar feature configured with the site's own Google OAuth client credentials (Client ID and Client Secret entered in plugin settings) - this is explicitly non-default and requires deliberate administrator action to set up; and (2) the attacker must be able to reach the WordPress site's OAuth callback URL over the network (standard internet access for public sites). No authentication, user interaction, or existing session is required once these conditions are met. Exploitation is limited to sites where the Google Calendar OAuth integration has been actively configured; sites using the plugin only for basic booking without Google Calendar, or using a shared/vendor-managed OAuth client rather than their own, are not exploitable. The AC:H CVSS rating reflects this configuration dependency as the primary limiting factor.

The NVD CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L correctly encodes the high attack complexity (AC:H) caused by the prerequisite that the target site must have its own Google OAuth client configured - a non-default setup. EPSS at 0.14% (3rd percentile) corroborates low widespread exploitation probability, which is consistent with a niche vertical plugin and a configuration-dependent condition. A publicly available proof-of-concept (WPScan) raises practical risk above the EPSS baseline for targeted campaigns against identified sites. KEV status is absent, indicating no confirmed broad active exploitation at time of analysis. The official CVSS vector rates confidentiality as N, but this may understate risk: hijacking the OAuth integration routes future booking appointment data (customer names, appointment times) to the attacker's Google account, warranting C:L in an independent assessment. Integrity and availability impacts are real but bounded - only the calendar sync feature is disrupted, not the core booking database. Overall, this is a genuine but narrow-scope threat: high severity for affected sites that have Google Calendar configured, but not a mass-exploitation priority.

An attacker scans for WordPress sites running Salon Booking System and identifies one with Google Calendar configured via its own OAuth client (detectable via exposed plugin metadata or calendar-related public-facing UI elements). The attacker submits a crafted HTTP GET or POST request to the plugin's OAuth callback endpoint, supplying an authorization code or token from an attacker-controlled Google account, without any session cookie or nonce. The plugin stores these credentials without validating the state parameter or checking WordPress capabilities, permanently replacing the salon's Google tokens; all subsequent appointment syncs are routed to the attacker's Google Calendar. A public proof-of-concept from WPScan demonstrates this technique.