CVE-2026-17022 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard
Unauthenticated attackers can access other customers' personal booking records by manipulating sequential booking identifiers in the Salon Booking System plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-17022?
CVE-2026-17022 is a high-severity vulnerability in Unknown Salon Booking System, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Weakness: CWE-200
Which versions are affected by CVE-2026-17022?
How do I fix CVE-2026-17022?
No fix has been published for CVE-2026-17022 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-17022 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-17022 exists.
Sources
Also known as GHSA-9jp6-8vxq-2865.