Is CVE-2026-40768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40768 being exploited in the wild.

How severe is CVE-2026-40768?

High severity, with a CVSS score of 7.3, published 17 June 2026.

Which products and versions are affected?

Dimitri Grassi Salon booking system <= 10.30.24.

Is there a fix for CVE-2026-40768?

A patch was published on 2026-04-21: Version 10.30.25 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40768 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40768?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40768: Dimitri Grassi Salon booking system unauthenticated IDOR

Q: Is there a fix for CVE-2026-40768?

A patch was published on 2026-04-21: Version 10.30.25 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40768 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-40768?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40768 · Severity: high · CVSS 7.3 · Published 2026-06-17

The Salon booking system plugin for WordPress, which manages appointments and customer bookings, contains a security flaw that allows unauthorized individuals to access or modify data. An attacker could exploit this to view sensitive booking information or interfere with the database without needing a password. This could lead to the exposure of customer details or disruption of business operations.

Quick answers

Is CVE-2026-40768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40768 being exploited in the wild.
How severe is CVE-2026-40768?: High severity, with a CVSS score of 7.3, published 17 June 2026.
Which products and versions are affected?: Dimitri Grassi Salon booking system <= 10.30.24.
Is there a fix for CVE-2026-40768?: A patch was published on 2026-04-21: Version 10.30.25 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40768 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40768?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Salon booking system plugin for WordPress (versions <= 10.30.24). The flaw, classified as CWE-639, stems from insufficient authorization checks when accessing internal objects via user-supplied input. A remote, unauthenticated attacker can exploit this by manipulating identifiers in requests to bypass access controls. This may allow the attacker to view sensitive files, access customer booking data, or interact with the database. The issue is resolved in version 10.30.25.

Affected products

Dimitri Grassi Salon booking system <= 10.30.24

Timeline

2026-03-06: disclosed: Reported by Lubin Regnault
2026-04-21: advisory: Patchstack advisory published
2026-06-17: disclosed: CVE published to NVD
2026-04-21: patched: Version 10.30.25 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.