CVE-2026-17022 Salon Booking System CVE debrief

Who should care

Users of the Salon Booking System WordPress plugin, administrators of affected systems, and security teams responsible for vulnerability management should be aware of this issue. They should verify the plugin version, restrict access to booking records, and monitor for suspicious activity to mitigate potential risks.

Technical summary

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier. This issue arises from inadequate validation of booking ownership tokens, which can lead to unauthorized access to sensitive booking information.

Defensive priority

Unauthenticated attackers can disclose sensitive booking records, including personal information.

Recommended defensive actions

• Verify the plugin version and check for updates
• Restrict access to booking records
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The evidence provided is limited; verify affected scope, vendor remediation status, and defensive priorities. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources