Description
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Salon Booking System | < 10.30.34 | 10.30.34 |
References
- https://wpscan.com/vulnerability/ddc84492-408b-477c-ac6c-b9ec96ccf223/ exploit vdb-entry technical-description