7.5
Élevée
CVE-2026-17022 The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before…
Description
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Salon booking system 10.30 | premières → < 10.30.34 | 10.30.34 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Salon booking system
Les 21 CVE de Salon booking system →
CVE-2026-110034
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a…
3.7
Faible
CVE-2026-110033
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching…
6.8
Moyenne
CVE-2026-110032
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles…
5.5
Moyenne
CVE-2026-110035
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon…
4.3
Moyenne