WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

CVE-2026-17021

The Salon Booking System WordPress plugin (Free Version) is vulnerable to unauthenticated arbitrary booking total tampering in versions before 10.30.34 . The root cause is a failure to properly restrict access to specific booking-modification AJAX actions and a lack of ownership verification for ...