WordPress security changelog
MEDIUM CVE-2026-17023 Deferred

Salon Booking System OAuth callback permits calendar integration hijack

Salon Booking System through 10.30.33 performs neither a capability check nor OAuth state validation on its Google Calendar authorization callback, which is registered for unauthenticated visitors. When a site has configured its own Google OAuth client for the calendar feature, an unauthenticated attacker can supply attacker-controlled authorization data, overwrite the stored Google Calendar tokens and hijack the integration.

CVE / CNA score 4.8 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Salon Booking System
Plugin slug
salon-booking-system
Affected
<= 10.30.33
Safe version
> 10.30.33
Published
Aug 10, 2026
Weakness
CWE-284 — Improper Access Control

This CVE was published Aug 10, 2026 and is one of 36 known issues for this plugin.

Update, patch or deactivate.

Update to a vendor-confirmed release after 10.30.33 when available; until then disconnect or disable Google Calendar integration or deactivate the plugin. Revoke unexpected Google OAuth grants, reconnect with known-good credentials and review calendar activity for unauthorized access or changes.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary and upstream sources