Skip to main content

Salon Booking System EUVDEUVD-2026-55007

| CVE-2026-17020 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-10 WPScan GHSA-pf8j-pw7h-gqgp
Authentication Bypass WordPress Salon Booking System
4.3
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
4.3 MEDIUM

Network-accessible REST API (AV:N), no special conditions (AC:L), subscriber account required (PR:L), confidentiality-only PII impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

4
Analysis Generated
Aug 11, 2026 - 23:47 vuln.today
CVSS changed
Aug 11, 2026 - 21:22 NVD
4.3 (MEDIUM)
CVE Published
Aug 10, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 06:00 cve.org
MEDIUM 4.3

DescriptionCVE.org

The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Register free customer account on target site
Delivery
Authenticate to WordPress REST API
Exploit
Issue GET requests with enumerated booking IDs
Execution
Bypass ownership verification check
Impact
Retrieve victim PII and private notes at scale
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold at least a subscriber-level or self-registered customer WordPress account on the targeted site - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the attack profile: network-reachable, low complexity, low-privilege authenticated access with confidentiality-only impact and unchanged scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a free customer account on a target salon's WordPress site, then uses the publicly available WPScan proof-of-concept to issue authenticated REST API calls with sequentially incremented booking identifiers. Without triggering any ownership check, the endpoint returns full booking records for all other customers, exposing names, email addresses, phone numbers, home addresses, and private appointment notes at scale.
Remediation Upgrade the Salon Booking System WordPress plugin to a version beyond 10.30.33; the exact patched release is not independently confirmed from available input data, so administrators must consult the plugin's official WordPress.org changelog and the WPScan advisory at https://wpscan.com/vulnerability/6e7852e9-0acd-4a79-9240-b864b14459a3/ to identify the confirmed fixed release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Salon Booking System

View all
CVE-2024-4442 CRITICAL
9.1 May 21

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and includ
CVE-2024-3229 CRITICAL
9.8 Jun 19

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio
CVE-2026-17022 HIGH POC
7.5 Aug 10

Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) expose
CVE-2022-0920 HIGH POC
7.5 Apr 11

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its end
CVE-2024-2603 MEDIUM POC
6.3 Apr 26

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a
CVE-2024-30510 CRITICAL
10.0 Mar 29

Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.5. Rated crit
CVE-2021-24429 MEDIUM POC
6.1 Jul 12

The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when b
CVE-2026-66453 CRITICAL
9.8 Aug 13

Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthe
CVE-2024-2101 MEDIUM POC
5.7 Apr 17

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field wh
CVE-2026-17021 MEDIUM POC
5.3 Aug 10

Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote vis
CVE-2022-0919 MEDIUM POC
5.3 Apr 11

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching boo
CVE-2024-37231 CRITICAL
9.1 Jun 24

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Sal

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-55007 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy