Booking Data Exposure in Salon Booking System from WordPress Plugin
CVE-2026-17022
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-17022?
The Salon Booking System WordPress plugin, up to version 10.30.33, suffers from a vulnerability due to its inadequate validation of booking ownership tokens. This flaw allows unauthenticated attackers to access and disclose sensitive booking records of other customers by submitting a sequential booking identifier. Consequently, personal information associated with these bookings can be exposed, posing a significant risk to user privacy.
Affected Version(s)
Salon Booking System 0 <= 10.30.33
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.