Is CVE-2026-17022 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17022 being exploited in the wild.

How severe is CVE-2026-17022?

High severity, with a CVSS score of 7.5, published 10 August 2026.

Which products and versions are affected?

Salon Booking System before 10.30.34.

Is there a fix for CVE-2026-17022?

A patch was published on 2026-08-10: Version 10.30.34 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17022 attacked?

It is attacked over the network.

Am I affected by CVE-2026-17022?

Check whether you run Salon Booking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17022: Salon Booking System information disclosure via booking wizard

CVE-2026-17022 · Severity: high · CVSS 7.5 · Published 2026-08-10

The Salon Booking System WordPress plugin allows unauthenticated attackers to view other customers' booking details, including names, appointment times, and service information, by simply guessing sequential booking identifiers. This exposes sensitive personal and business information without any authentication or authorization checks, potentially compromising customer privacy and salon operations.

Technologies: Salon Booking System. Vendors: Salon Booking System.

Quick answers

Is CVE-2026-17022 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17022 being exploited in the wild.
How severe is CVE-2026-17022?: High severity, with a CVSS score of 7.5, published 10 August 2026.
Which products and versions are affected?: Salon Booking System before 10.30.34.
Is there a fix for CVE-2026-17022?: A patch was published on 2026-08-10: Version 10.30.34 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17022 attacked?: It is attacked over the network.
Am I affected by CVE-2026-17022?: Check whether you run Salon Booking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the booking-wizard confirmation steps where the plugin fails to properly validate ownership tokens before loading booking records. An attacker can request booking pages with sequential booking IDs (e.g., ?sln_step_page=thankyou&op=x-8) without authentication to retrieve other customers' bookings. The plugin uses predictable WordPress post IDs for booking enumeration, allowing attackers to systematically discover and access any booking regardless of status. The attack requires network access to the public booking page and no user interaction, making it trivially exploitable. The vulnerability was patched in version 10.30.34.

Affected products

Salon Booking System Salon Booking System before 10.30.34

Timeline

2026-08-06: disclosed
2026-08-10: patched: Version 10.30.34

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.