Salon Booking System OAuth callback permits calendar integration hijack
Salon Booking System through 10.30.33 performs neither a capability check nor OAuth state validation on its Google Calendar authorization callback, which is registered for unauthenticated visitors. When a site has configured its own Google OAuth client for the calendar feature, an unauthenticated attacker can supply attacker-controlled authorization data, overwrite the stored Google Calendar tokens and hijack the integration.
- Component
- Salon Booking System
- Plugin slug
salon-booking-system- Affected
- <= 10.30.33
- Safe version
> 10.30.33- Published
- Aug 10, 2026
This CVE was published Aug 10, 2026 and is one of 36 known issues for this plugin.
Update, patch or deactivate.
Update to a vendor-confirmed release after 10.30.33 when available; until then disconnect or disable Google Calendar integration or deactivate the plugin. Revoke unexpected Google OAuth grants, reconnect with known-good credentials and review calendar activity for unauthorized access or changes.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L