CVE-2026-17021CWE-862broken-access-control

CVE-2026-17021

Medium · published August 10, 2026

CVSS v3.1

5.3

EPSS

Percentile

21.9

In the wild

Unconfirmed

What it is

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00304 · 21.9th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-10T11:16Z

References (1)

https://wpscan.com/vulnerability/fbbfa907-3efd-4050-9651-d3836af062a9/ · [email protected]

EPSS history

Timeline

10 AUG 06:00Z
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Arbitrary Booking Total Tampering
cvelistv5