CVE-2026-17021

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

Affected

Salon Booking System

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 22nd percentile

Published

2026-08-10

Updated

2026-08-13

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/fbbfa907-3efd-4050-9651-d3836af062a9/

References

• CVE Record
• NVD entry