What is the CVSS score of CVE-2026-40768?

CVE-2026-40768 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Salon Booking System are affected by CVE-2026-40768?

The Salon Booking System WordPress plugin (versions ≤ 10.30.24) contains an unauthenticated vulnerability allowing attackers to directly access and modify customer booking records without…

How to fix or mitigate CVE-2026-40768?

24 hours: Audit deployed plugin versions across all WordPress environments; check access logs for suspicious booking modifications; assess number of potentially exposed customer records. 7 days: Implement access restrictions via Web Application Firewall or disable the plugin if booking services are not mission-critical; communicate findings to affected customers. 30 days: Coordinate with vendor on patch timeline; evaluate migration to alternative booking platforms if patch is not released within acceptable organizational risk timeframe.

Salon Booking System CVE-2026-40768

EUVD-2026-37604 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-17 Patchstack

Authentication Bypass Salon Booking System

7.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable WordPress plugin endpoint with no auth or interaction (AV:N/AC:L/PR:N/UI:N); IDOR yields per-record read/modify/cancel impact, so C/I/A are Low and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:13 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.

AnalysisAI

Unauthenticated Insecure Direct Object Reference in the Salon Booking System WordPress plugin (versions <= 10.30.24) allows remote attackers to access or manipulate booking objects belonging to other users by tampering with object identifiers in requests. The flaw was reported by Patchstack and affects the dimitri_grassi salon_booking_system plugin per the provided CPE, with no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the Salon Booking System WordPress plugin authored by Dimitri Grassi (CPE cpe:2.3:a:dimitri_grassi:salon_booking_system), used by service businesses to manage appointments, customers, and payments within WordPress. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): endpoints reference internal objects (such as booking IDs, customer records, or reservation tokens) directly via request parameters without verifying that the caller is authorized to act on that specific object. Because the plugin runs inside WordPress's HTTP request lifecycle and the CVSS vector indicates no authentication is required, the vulnerable endpoint is reachable by anonymous web clients.

RemediationAI

Patch available per vendor advisory: upgrade the Salon Booking System WordPress plugin to a release newer than 10.30.24 as published by the vendor and tracked in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-30-24-insecure-direct-object-references-idor-vulnerability; an exact fixed version is not enumerated in the supplied data, so verify the current plugin release on the WordPress.org listing before deploying. If immediate patching is not possible, restrict access to the plugin's booking-management endpoints at the web server or WAF layer (for example, allowlisting authenticated /wp-admin sessions or blocking unauthenticated requests to the plugin's AJAX/REST routes), accepting that this may break legitimate public booking flows; alternatively, deactivate the plugin until updated, which removes booking functionality but eliminates exposure.