Not rated
CVE-2022-0919 The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching…
Description
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Salon booking system 7.6 | earliest → < 7.6.3 | 7.6.3 |
| Salon Booking System Pro 7.6 | earliest → < 7.6.3 | 7.6.3 |
Other CVEs of Salon booking system
The 21 CVEs of Salon booking system →
CVE-2026-110034
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a…
3.7
Low
CVE-2026-110033
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching…
6.8
Medium
CVE-2026-110032
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles…
5.5
Medium
CVE-2026-110035
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon…
4.3
Medium