Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-17021

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Salon Booking System

Default version status: unaffected

  • 0 to < 10.30.34affected

References