CVE-2026-17020 Salon Booking System CVE debrief

Who should care

WordPress site administrators using the Salon Booking System plugin, security teams monitoring for authenticated user access vulnerabilities, users of the affected plugin, and those responsible for maintaining customer data privacy and security in WordPress environments should be aware of this vulnerability. It's crucial for them to assess their exposure, review current API endpoint access controls, and plan for necessary updates or mitigations to protect customer personal data such as names, emails, phone numbers, addresses, and private notes from potential disclosure via enumeration of booking identifiers by authenticated users with basic read capability. This includes verifying plugin versions, restricting authenticated user permissions, and enhancing monitoring for potential misuse of REST API endpoints related to booking data access and manipulation. Additionally, they should consider compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets to ensure thorough mitigation of this vulnerability's impact on customer data privacy and security in their WordPress environments. This vulnerability affects not just technical teams but also customer service and privacy compliance teams due to the sensitive nature of the data at risk. Therefore, a coordinated response involving technical, operational, and compliance teams is necessary to address this vulnerability effectively and minimize potential impact on affected WordPress sites and their users' data security and privacy. This includes reviewing current security practices for managing and protecting sensitive customer information in WordPress environments and ensuring that appropriate measures are in place to detect, respond to, and mitigate potential security incidents related to this vulnerability in the Salon Booking System plugin. By taking proactive steps to understand and mitigate this vulnerability, organizations can better protect their customers' sensitive information and maintain trust in their ability to safeguard personal data. This proactive approach also supports compliance with data protection regulations and standards by

Technical summary

The Salon Booking System WordPress plugin through 10.30.33 has a vulnerability in one of its REST API endpoints, allowing any authenticated user to disclose personal data of any customer's booking, such as name, email, phone number, address, and private notes, by enumerating booking identifiers. This requires only a basic read capability, which includes Subscriber or self-registered customer accounts.

Defensive priority

Authenticated users may access sensitive booking information; verify and restrict API endpoint access.

Recommended defensive actions

• Verify API endpoint access controls
• Restrict authenticated user permissions
• Monitor for suspicious API activity
• Update plugin to latest version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE and NVD entries provide limited details on the Salon Booking System WordPress plugin vulnerability (CVE-2026-17020). To comprehensively assess the impact, verify with the vendor and additional sources. Specifically, defenders should check if their plugin version is affected, review API endpoint access controls, and monitor for suspicious activity related to booking identifiers.

Official resources