CVE-2022-0920

Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data

Affected

Salon booking system · Salon Booking System Pro

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.45% chance of exploitation in the next 30 days, 73rd percentile

Published

2022-04-11

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5a5ab7a8-be67-4f70-925c-9cb1eff2fbe0

References

• CVE Record
• NVD entry