Description
The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer-s booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
CVSS 4.3EPSS 0.132%Risque 0.44
Voir la source- Publication
- 2026-08-10 07:16:49
- Dernière modification
- 2026-08-11 21:17:29
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N