CVE-2026-17021: Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Arbitrary Booking Total Tampering
The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17021?
CVE-2026-17021 has a risk score of 45, indicating a medium severity vulnerability.
How do I fix CVE-2026-17021?
To mitigate CVE-2026-17021, update the Salon Booking System WordPress plugin to version 10.30.34 or later.
What type of vulnerability is CVE-2026-17021?
CVE-2026-17021 is an unauthenticated arbitrary booking total tampering vulnerability.
Which versions of the Salon Booking System are affected by CVE-2026-17021?
CVE-2026-17021 affects the Salon Booking System free version up to and including 10.30.33.
What impact does CVE-2026-17021 have on my WordPress site?
CVE-2026-17021 allows unauthenticated users to tamper with booking totals, potentially leading to financial discrepancies.