CVE-2026-17023

The CVE affects the Salon Booking System WordPress plugin (≤ 10.30.33). The Google Calendar integration is vulnerable because there is no capability check or OAuth state validation on the authorization callback, and the callback is also accessible to unauthenticated users. An unauthenticated atta...