CVE-2026-17023

Katalog CVE

CVSS 4.8 · Medium EPSS 0,27%

Kerentanan Improper Access Control. Skor CVSS 3.1 4.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

Rincian

Terbit di NVD

10 Agustus 2026

Terakhir diubah

26 Agustus 2026

Status NVD

Deferred

CVSS 3.1

4.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/a116db0a-38ea-43e3-a9cd-991768ce3e07/