CVE-2026-17020: Salon Booking System – Free Version <= 10.30.33 - Subscriber+ Arbitrary Booking PII Disclosure via IDOR
The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17020?
CVE-2026-17020 has a risk score of 62, indicating a medium-level vulnerability.
How do I fix CVE-2026-17020?
To fix CVE-2026-17020, update the Salon Booking System plugin to a version newer than 10.30.33.
What does CVE-2026-17020 allow an attacker to do?
CVE-2026-17020 allows authenticated users to disclose arbitrary booking personal identifiable information (PII) due to insufficient verification.
Who is affected by CVE-2026-17020?
Any authenticated users, including Subscribers or self-registered customers, are affected by CVE-2026-17020.
When was CVE-2026-17020 published?
CVE-2026-17020 was published on August 10, 2026.