CVE-2026-40768

WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability

Published Jun 17, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Description

Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.

Analysis

Technical impact

The vulnerability is an unauthenticated IDOR that enables an attacker to read or modify booking objects they should not access. Classified as CWE-639, the plugin fails to confirm that the user is authorized for the requested resource. Successful exploitation can expose or alter sensitive booking data, compromising privacy and reliable service.

Affected Systems

Vendor Dimitri Grassi’s WordPress Salon booking system plugin is affected. Versions up to and including 10.30.24 contain the flaw; the issue is fixed in 10.30.25 and later. Any WordPress installation using the plugin in that range is at risk.

Risk and Exploitability

The CVSS score of 7.3 signals high severity. No EPSS data is available, yet the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread public exploits yet. The attack vector is web‑based and unauthenticated, relying on manipulation of booking identifiers in URLs or API requests. An attacker could simply enumerate or guess booking IDs to access data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dimitri Grassi

Salon booking system

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 10.30.24

No data.

Vendor Product Versions

Dimitri Grassi

Salon Booking System

Version	Status	Scheme	Platform
`[0,10.30.24]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

Vendor Solution

Update the WordPress Salon booking system Plugin to the latest available version (at least 10.30.25).

OpenCVE Recommended Actions

Update the WordPress Salon booking system plugin to version 10.30.25 or later as recommended by the vendor.
Enforce strict role‑based access controls so that only authorized users can view or edit bookings, and validate all booking identifiers server‑side.
Enable logging of booking ID usage, review logs for anomalous access patterns, and restrict direct object reference usage where possible.

Generated by OpenCVE AI on June 18, 2026 at 12:14 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.288% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-30-24-insecure-direct-object-references-idor-vulnerability?_s_id=cve

History

Jun 21, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dimitri Grassi Dimitri Grassi salon Booking System Wordpress Wordpress wordpress
Vendors & Products		Dimitri Grassi Dimitri Grassi salon Booking System Wordpress Wordpress wordpress

Jun 18, 2026 4:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 17, 2026 11:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
Title		WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability
Weaknesses		CWE-639
References		https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-30-24-insecure-direct-object-references-idor-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}`