CVE-2026-17020 Overview
CVE-2026-17020 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Salon Booking System WordPress plugin through version 10.31.0. The plugin exposes a REST API endpoint that fails to verify booking ownership. Any authenticated user with a basic read capability, including Subscribers or self-registered customer accounts, can enumerate booking identifiers to disclose other customers' personal data. Exposed data includes names, email addresses, phone numbers, physical addresses, and private notes attached to bookings.
Critical Impact
Authenticated low-privileged users can enumerate booking IDs to harvest personal data of every salon customer, enabling large-scale privacy breaches and follow-on phishing or fraud.
Affected Products
- Salon Booking System WordPress plugin versions through 10.31.0
- WordPress sites permitting self-registration or Subscriber-level accounts
- Salon and appointment-based businesses using the plugin's REST API
Discovery Timeline
- 2026-08-10 - CVE-2026-17020 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-17020
Vulnerability Analysis
The vulnerability is a classic Insecure Direct Object Reference flaw in a REST API endpoint exposed by the Salon Booking System plugin. The endpoint accepts a booking identifier as input and returns the associated booking record. It enforces authentication and a basic read capability check, but omits an ownership check tying the requested booking ID to the calling user.
This authorization gap means any logged-in WordPress user can query bookings that belong to other customers. On sites that allow customer self-registration, this drops the exploitation barrier to registering a free account. Attackers can iterate through sequential numeric booking IDs and extract full personal data records at scale.
The disclosed fields include customer name, email address, phone number, physical address, and private notes. This dataset supports downstream attacks such as targeted phishing, identity fraud, and physical stalking. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Root Cause
The REST API endpoint validates that the caller is authenticated and holds a read capability, but does not compare the booking record's owner to the current user ID. Authorization is treated as a coarse capability check rather than a per-object ownership check.
Attack Vector
An attacker obtains a low-privileged account, either by self-registration on a public salon site or by compromising an existing Subscriber account. The attacker then issues authenticated HTTP requests to the vulnerable REST endpoint, incrementing the booking ID parameter to enumerate every booking on the site. See the WPScan Vulnerability Report for endpoint specifics.
Detection Methods for CVE-2026-17020
Indicators of Compromise
- High-volume authenticated requests from a single user session to the Salon Booking System REST API endpoint
- Sequential or rapid iteration of numeric booking ID parameters in /wp-json/ request logs
- New Subscriber or customer registrations followed shortly by REST API booking lookups
- Unusual outbound data volume from wp-json responses tied to a single authenticated user
Detection Strategies
- Parse WordPress and web server access logs for authenticated GET requests to the plugin's booking REST route with varying id values from the same session
- Alert on any single WordPress user account retrieving more bookings than they own within a short time window
- Baseline normal Subscriber activity and flag deviations involving REST API enumeration patterns
Monitoring Recommendations
- Enable verbose REST API request logging in WordPress and forward logs to a centralized SIEM for correlation
- Monitor the wp_users table for spikes in self-registrations preceding REST API activity
- Track response sizes on plugin REST endpoints; sustained large aggregate transfers to one user indicate enumeration
How to Mitigate CVE-2026-17020
Immediate Actions Required
- Update the Salon Booking System plugin to a version later than 10.31.0 once a vendor patch is released
- Disable open WordPress user registration on affected sites until patched
- Audit existing Subscriber and customer accounts for anomalous REST API activity against booking endpoints
- Notify affected customers if enumeration activity is confirmed, in line with applicable privacy regulations
Patch Information
At the time of publication, the vulnerability is confirmed in versions through 10.31.0. Administrators should consult the WPScan Vulnerability Report and the plugin's official changelog for the fixed release version and apply it as soon as available.
Workarounds
- Restrict access to the vulnerable REST API endpoint at the web server or Web Application Firewall (WAF) layer, permitting only administrator IP ranges
- Temporarily deactivate the Salon Booking System plugin on sites where booking functionality is not business-critical
- Enforce Multi-Factor Authentication (MFA) on all WordPress accounts and disable self-registration to raise the barrier for exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
