CVE-2026-17023: Unknown Salon Booking System

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

Affected products

• Unknown Salon Booking System: up to and including 10.30.33

Published 2026-08-10. Last modified 2026-08-26.