What is GHSA-jf35-5rcj-7rqm?

GHSA-jf35-5rcj-7rqm is a security advisory published by GitHub Security Advisories with Medium severity. The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to...

Which CVE IDs does GHSA-jf35-5rcj-7rqm cover?

GHSA-jf35-5rcj-7rqm covers the following CVE IDs: CVE-2026-17021. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jf35-5rcj-7rqm?

GHSA-jf35-5rcj-7rqm has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-jf35-5rcj-7rqmMediumCVSS 5.3

The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-17021 →

📋 Description

The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-17021
https://wpscan.com/vulnerability/fbbfa907-3efd-4050-9651-d3836af062a9
https://github.com/advisories/GHSA-jf35-5rcj-7rqm