CVE-2026-17023 Overview
CVE-2026-17023 affects the Salon Booking System WordPress plugin through version 10.30.33. The plugin fails to perform a capability check or validate an OAuth state value on its Google Calendar authorization callback. The callback is hooked for unauthenticated users, exposing the endpoint to anonymous requests. An unauthenticated attacker can overwrite the site's stored Google Calendar connection tokens with attacker-controlled credentials and hijack the integration. Exploitation requires the target site to have configured its own Google OAuth client for the calendar feature. The weakness maps to [CWE-284: Improper Access Control].
Critical Impact
Unauthenticated attackers can hijack the Google Calendar integration by overwriting stored OAuth tokens, redirecting booking data to attacker-controlled accounts.
Affected Products
- Salon Booking System WordPress plugin, versions up to and including 10.30.33
- WordPress sites that have configured a Google OAuth client for calendar integration
- Deployments exposing the Google Calendar authorization callback to unauthenticated traffic
Discovery Timeline
- 2026-08-10 - CVE-2026-17023 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-17023
Vulnerability Analysis
The Salon Booking System plugin exposes a Google Calendar OAuth authorization callback endpoint that WordPress hooks for both authenticated and unauthenticated users. The callback handler processes token data returned from the OAuth flow and writes those tokens into the site's persistent plugin configuration. The handler omits two controls that OAuth callbacks require. First, no WordPress capability check restricts who may invoke the endpoint. Second, no state parameter validation ties the incoming callback to a legitimate authorization request initiated by a site administrator. An attacker who reaches the callback URL with crafted parameters can therefore persist arbitrary OAuth token material into the plugin. Once persisted, the plugin uses those tokens for subsequent Google Calendar API interactions, effectively rerouting the integration.
Root Cause
The root cause is missing authorization and missing anti-forgery state validation on the OAuth redirect handler. The plugin registers the callback for unauthenticated request contexts and trusts the query-string content without verifying either the caller's identity or the origin of the OAuth flow.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. The attacker sends a crafted HTTP request to the plugin's Google Calendar authorization callback URL on a vulnerable site whose administrator has previously configured a Google OAuth client. Attack complexity is elevated because the target must have completed OAuth client provisioning, and the attacker must possess or generate OAuth tokens the plugin will accept.
No verified proof-of-concept code has been released. Refer to the WPScan Vulnerability Report for technical detail.
Detection Methods for CVE-2026-17023
Indicators of Compromise
- Unexpected HTTP requests to the plugin's Google Calendar OAuth callback endpoint from unauthenticated sessions or unfamiliar source IPs
- Google Calendar connection token values in the plugin configuration that differ from the administrator's registered Google account
- Booking events or calendar entries appearing in or disappearing from an unfamiliar Google Calendar account tied to the site
Detection Strategies
- Review web server access logs for GET requests targeting the Salon Booking System Google Calendar callback path, especially those lacking a valid WordPress admin session cookie
- Alert on changes to the plugin's stored refresh_token or access_token option values outside of legitimate administrator activity windows
- Correlate WordPress wp_options write events with the source IP of the triggering request to identify anonymous token overwrites
Monitoring Recommendations
- Enable file integrity and database option monitoring on WordPress sites running the Salon Booking System plugin
- Forward WordPress and web server logs to a central analytics platform and build detections for anonymous access to OAuth callback URLs
- Audit connected Google Cloud OAuth clients periodically to confirm the authorized redirect URIs and account associations remain expected
How to Mitigate CVE-2026-17023
Immediate Actions Required
- Update the Salon Booking System plugin to a version later than 10.30.33 once the vendor publishes a fix
- Revoke and reissue any Google OAuth client credentials currently used by the plugin, then reconnect the calendar under a trusted administrator session
- Inspect stored plugin tokens and remove any values that were not established by an authorized administrator
Patch Information
At the time of publication, no fixed version is referenced in the available advisory data. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for a security release addressing versions up to 10.30.33.
Workarounds
- Temporarily disable the Salon Booking System plugin's Google Calendar integration until a patched version is available
- Restrict access to the plugin's OAuth callback URL at the web server or WAF layer, allowing only requests originating from administrator IP ranges
- Rotate the Google OAuth client secret and remove unused authorized redirect URIs from the Google Cloud console to shrink the attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
