WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

CVE-2026-17021

CVE-2026-17021 affects the Salon Booking System for WordPress, up to version 10.30.33. The vulnerability arises because some booking-modification AJAX actions are not properly restricted and ownership of the targeted booking is not verified, enabling unauthenticated users to tamper with the store...

CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...