# CVE-2026-17023: Salon Booking System OAuth state validation bypass

Source: https://junglewise.ai/threats/cve-2026-17023-salon-booking-system-oauth-state-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17023 · Severity: medium · CVSS 4.8 · Published 2026-08-10

The Salon Booking System WordPress plugin fails to validate OAuth state parameters and authenticate requests in its Google Calendar integration callback, allowing unauthenticated attackers to hijack the site's Google Calendar connection. An attacker can replace the site's stored calendar tokens with their own, severing the legitimate owner's integration and gaining control over the calendar sync feature. This requires the site to have manually configured Google OAuth credentials for the calendar feature.

Technologies: [Salon Booking System](https://junglewise.ai/threats/technologies/salon-booking-system). Vendors: [Salon Booking System](https://junglewise.ai/threats/vendors/salon-booking-system).

## Quick answers

**Is CVE-2026-17023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17023 being exploited in the wild.

**How severe is CVE-2026-17023?** Medium severity, with a CVSS score of 4.8, published 10 August 2026.

**Which products and versions are affected?** Salon Booking System through 10.30.33.

**Is there a fix for CVE-2026-17023?** A patch was published on 2026-08-10: Fixed in version 10.31.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17023 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-17023?** Check whether you run Salon Booking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue (CWE-284) in the Google Calendar OAuth callback handler. The plugin accepts OAuth authorization codes from unauthenticated requests without validating the state parameter or checking user capabilities, and directly exchanges these codes for access tokens using the site's OAuth credentials. An attacker who completes the Google OAuth consent flow with a target site's registered Client ID can supply their resulting authorization code via an unauthenticated GET request to the wp-admin/admin-ajax.php?action=googleoauth-callback endpoint, causing the plugin to store the attacker's tokens site-wide. The vulnerability is fixed in version 10.31.3.

## Affected products

- Salon Booking System Salon Booking System through 10.30.33

## Timeline

- 2026-08-06: disclosed
- 2026-08-10: patched: Fixed in version 10.31.3

## References

- [https://wpscan.com/vulnerability/a116db0a-38ea-43e3-a9cd-991768ce3e07/](https://wpscan.com/vulnerability/a116db0a-38ea-43e3-a9cd-991768ce3e07/)

## Related threats

- [The Salon Booking System missing authorization in REST API endpoint](https://junglewise.ai/threats/cve-2026-110035-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin SSRF and stored XSS in image URL](https://junglewise.ai/threats/cve-2026-110033-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System WordPress plugin insufficient access control in customer editor](https://junglewise.ai/threats/cve-2026-110032-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System plugin privilege escalation](https://junglewise.ai/threats/cve-2026-110031-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin CSRF in REST API](https://junglewise.ai/threats/cve-2026-110015-the-salon-booking-system-wordpress-plugin-before-10-31-9-does)