4.8
Medium
CVE-2026-17023 The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth…
Description
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Salon booking system 10.30 | earliest → 10.30.33 | No fix stated |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Salon booking system
The 21 CVEs of Salon booking system →
CVE-2026-110034
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a…
3.7
Low
CVE-2026-110033
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching…
6.8
Medium
CVE-2026-110032
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles…
5.5
Medium
CVE-2026-110035
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon…
4.3
Medium