CVE-2026-17022 Overview
CVE-2026-17022 affects the Salon Booking System WordPress plugin in versions prior to 10.30.34. The plugin fails to validate a booking's ownership token before loading it in the booking-wizard confirmation steps. Unauthenticated attackers can supply sequential booking identifiers to disclose other customers' booking records, including personal information. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate booking IDs to harvest personally identifiable information (PII) from any customer stored in the plugin's booking records.
Affected Products
- Salon Booking System WordPress plugin versions before 10.30.34
- WordPress sites using the salon booking-wizard confirmation flow
- Customer booking records containing personal information managed by the plugin
Discovery Timeline
- 2026-08-10 - CVE-2026-17022 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-17022
Vulnerability Analysis
The Salon Booking System plugin exposes a booking-wizard confirmation workflow that loads booking records based on an identifier passed through the request. The plugin issues an ownership token intended to bind a booking record to the customer who created it. The confirmation logic loads records using a sequential booking identifier without checking whether the supplied token matches the record being requested.
An unauthenticated attacker can iterate through sequential booking IDs and retrieve the confirmation page for each record. The response reveals booking metadata and customer personal information such as names, contact details, and appointment data. Because the vulnerability requires no authentication or user interaction, mass enumeration is trivial to automate against affected sites.
Root Cause
The root cause is missing authorization enforcement on the booking retrieval path. The plugin trusts the booking identifier supplied by the client and does not compare the request's ownership token against the token stored with the booking record. This pattern falls under Insecure Direct Object Reference (IDOR) combined with broken access control.
Attack Vector
The attack vector is network-based over HTTP or HTTPS. An attacker requests the booking-wizard confirmation endpoint while incrementing the booking identifier parameter. Because identifiers are sequential, attackers can predict valid values without prior knowledge. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-17022
Indicators of Compromise
- Sequential or rapid requests to the plugin's booking-wizard confirmation endpoint from a single source IP address
- Elevated 200 OK response rates on booking confirmation URLs containing incrementing numeric identifiers
- Access logs showing missing or repeated ownership token values across many distinct booking IDs
Detection Strategies
- Inspect web server access logs for enumeration patterns targeting the booking-wizard confirmation route
- Alert on unauthenticated user agents accessing more than a threshold of distinct booking IDs within a short window
- Correlate outbound PII exposure with unauthenticated sessions in application logs
Monitoring Recommendations
- Enable verbose access logging for the WordPress wp-admin/admin-ajax.php handler and plugin front-end routes
- Deploy a web application firewall rule to rate-limit requests to the booking confirmation endpoint
- Monitor for scraping behaviors targeting sequential resource identifiers across plugin endpoints
How to Mitigate CVE-2026-17022
Immediate Actions Required
- Upgrade the Salon Booking System plugin to version 10.30.34 or later on all WordPress instances
- Audit booking records for evidence of enumeration or unauthorized access from external IP ranges
- Notify affected customers if log analysis confirms unauthorized disclosure of their personal information
Patch Information
The vendor addressed CVE-2026-17022 in Salon Booking System version 10.30.34. The fix enforces ownership token validation before loading booking records in the booking-wizard confirmation steps. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to the booking confirmation endpoint via a WAF rule requiring a valid session cookie or referrer
- Temporarily disable the Salon Booking System plugin if patching cannot be applied immediately
- Apply rate limiting to booking-wizard URLs to slow enumeration until the update is deployed
# Configuration example - update the plugin via WP-CLI
wp plugin update salon-booking-system --version=10.30.34
wp plugin list --name=salon-booking-system --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
