CVE-2026-17020

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.30.34

Description An issue exists where a REST API endpoint fails to verify if a requested booking belongs to the user making the request. This allows any authenticated user, such as a Subscriber or self-registered customer, to access personal data of other customers—including names, emails, phone numbers, addresses, and private notes—by enumerating booking identifiers.

Recommendations Update the Salon Booking System WordPress plugin to version 10.30.34 or later.