What is the CVSS score of EUVD-2026-55005?

EUVD-2026-55005 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Salon Booking System are affected by EUVD-2026-55005?

The Salon Booking System WordPress plugin (version 10.30.33 and earlier) contains an unauthenticated vulnerability allowing attackers to retrieve customer booking records and personal information via…

Is there a public PoC exploit available for EUVD-2026-55005?

Yes, a public proof-of-concept exploit is available for EUVD-2026-55005. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-55005?

Within 24 hours: inventory all WordPress installations running Salon Booking System through version 10.30.33 and quantify customer records at risk. Within 7 days: either disable the plugin entirely and migrate to an alternative booking solution or deploy a Web Application Firewall rule blocking patterns of sequential booking ID enumeration requests. Within 30 days: complete migration to a patched or functionally equivalent alternative, conduct a log audit covering the past 90 days for exploitation evidence, and notify affected customers if unauthorized access is confirmed.

Salon Booking System EUVD-2026-55005

| CVE-2026-17022 HIGH

Information Exposure (CWE-200)

2026-08-10 WPScan

GHSA-9jp6-8vxq-2865

Information Disclosure WordPress Salon Booking System

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint, trivial sequential enumeration (AC:L), no credentials needed (PR:N), read-only PII disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:32 vuln.today

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

Articles & Coverage 1

News 8 New WordPress Vulnerabilities - 1 Critical, 7 High, All With POC Aug 11, 2026

AnalysisAI

Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Salon Booking System

Delivery

Send unauthenticated HTTP request with booking ID=1

Exploit

Observe returned customer booking record

Execution

Increment booking ID sequentially

Impact

Harvest full customer PII dataset

Access

Identify WordPress site running Salon Booking System

Delivery

Send unauthenticated HTTP request with booking ID=1

Exploit

Observe returned customer booking record

Execution

Increment booking ID sequentially

Impact

Harvest full customer PII dataset

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond the target site having the Salon Booking System WordPress plugin installed and active in a version through 10.30.33. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the attack surface: fully network-accessible, zero-complexity enumeration, requiring no authentication and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker discovers a WordPress site running the Salon Booking System plugin and sends HTTP GET requests to the booking-wizard confirmation endpoint, incrementing the booking ID parameter from 1 upward. Each valid response returns a booking record containing the customer's name, contact details, and appointment information. …
Remediation	The primary remediation is to update the Salon Booking System plugin to a version above 10.30.33. … Detailed patch versions, workarounds, and compensating controls in full report.