Description

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T07:16:49.243Z",
  "pubdate": "2026-08-10T07:16:49.243Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the Salon Booking System WordPress plugin through version 10.30.33. The flaw exists within the booking-wizard confirmation steps, where the application fails to adequately validate a booking's ownership token prior to retrieval and rendering.\nThis security deficiency allows unauthenticated remote attackers to bypass authorization controls and systematically harvest sensitive customer booking records and associated personal identifiable information (PII). Exploitation requires no privileged access, authentication tokens, or complex user interaction, relying purely on the enumeration of predictable, sequential booking identifiers.\nThe risk implications are severe regarding data privacy and confidentiality, as malicious actors can aggregate private customer data at scale over the network exposure boundary. Remediation requires enforcing strict cryptographic ownership token validation and proper session-to-booking authorization checks within the affected execution context of the booking-wizard.",
  "technicalDetails": "The vulnerability resides in the booking-wizard confirmation mechanism of the Salon Booking System WordPress plugin, affecting all versions up to 10.30.33. The root cause stems from a complete lack of server-side authorization validation regarding booking ownership tokens when processing requests to load reservation details.\nIn a secure implementation, the application should verify that the requesting entity holds a valid cryptographic session or an unguessable authorization token directly bound to the specific booking record. However, in the vulnerable component, the backend logic relies on predictable, sequential numeric identifiers to query and return reservation records.\nThe attack flow proceeds as follows: an unauthenticated attacker initiates an HTTP request targeting the booking-wizard confirmation endpoint. Instead of providing a cryptographically secure, randomized token proving ownership of the target resource, the attacker supplies a sequentially incremented or decremented numeric booking identifier within the request parameters.\nBecause the server-side controller fails to validate whether the current unauthenticated visitor is authorized to view the requested booking ID, the application processes the database query using the supplied sequential identifier. The vulnerable component subsequently retrieves the matching database record and reflects the full reservation details—including sensitive customer PII—in the HTTP response payload.\nNetwork exposure is fully external via standard HTTP/HTTPS protocols exposed by the WordPress site running the vulnerable plugin. The attack requires zero authentication and zero administrative or user privileges. Post-exploitation impact is characterized by mass data exfiltration of customer records, potentially violating data privacy regulations and facilitating secondary social engineering or identity theft attacks against registered users."
}