What’s Vulnerable › Vulnerabilities
CVE-2026-17023: Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-10 · updated 2026-08-26
- Weakness: CWE-284
Description
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
Affected products
- Salon booking system: through 10.30.33
References
Get alerted when CVE-2026-17023 or the next vulnerability affects your stack