Executive brief
The Salon Booking System WordPress plugin allows unauthenticated attackers to view other customers' booking details, including names, appointment times, and service information, by simply guessing sequential booking identifiers. This exposes sensitive personal and business information without any authentication or authorization checks, potentially compromising customer privacy and salon operations.
Technical details
The vulnerability exists in the booking-wizard confirmation steps where the plugin fails to properly validate ownership tokens before loading booking records. An attacker can request booking pages with sequential booking IDs (e.g., ?sln_step_page=thankyou&op=x-8) without authentication to retrieve other customers' bookings. The plugin uses predictable WordPress post IDs for booking enumeration, allowing attackers to systematically discover and access any booking regardless of status. The attack requires network access to the public booking page and no user interaction, making it trivially exploitable. The vulnerability was patched in version 10.30.34.
Affected products
- Salon Booking System Salon Booking System before 10.30.34
Timeline
- 2026-08-06: disclosed
- 2026-08-10: patched: Version 10.30.34