CVE-2022-0920: Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0920?
CVE-2022-0920 is considered a high severity vulnerability due to improper authorization in the Salon Booking System plugins.
How do I fix CVE-2022-0920?
To fix CVE-2022-0920, you should update the Salon Booking System plugin to version 7.6.3 or later.
What are the potential risks of CVE-2022-0920?
The risks of CVE-2022-0920 include unauthorized access to customer bookings and sensitive data.
Which versions of the Salon Booking System are affected by CVE-2022-0920?
CVE-2022-0920 affects versions of the Salon Booking System plugin prior to 7.6.3.
Is there a workaround for CVE-2022-0920?
While the best solution is to update the plugin, temporarily disabling user access to booking data can serve as a workaround until updates are applied.