Threat Investigation
Request a demo

CVE-2026-17021

Medium

Description

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

SeverityMedium
CVSS5.3
Exploit probability—
ProductSalon Booking System
PublishedAug 10, 2026
First seenAug 10, 2026
Weakness typeCWE-862Missing authorization

How to fix

Update
  • Salon Booking System10.30.34 or later

Affected products

ProductAffected versionsFixed in
Salon Booking Systemv < 10.30.3410.30.34

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.