medium5.3
CVE-2026-17021
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verif…
Impact
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Affected products
| Product | Affected versions |
|---|---|
| Salon Booking System WordPress Plugin | before 10.30.34 |
Versions were read from the advisory text. No structured product data has been published for this record yet.