Salon booking system <= 10.31.8 - Unauthenticated Authentication Bypass via Predictable Zapier API Key
- ID
- WPSEC-2026-0429
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- from 4.9.4 before 10.31.9
- Remediation
- Update to 10.31.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-330
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Salon booking system on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress uses an insufficiently random Zapier API key in versions 4.9.4 through 10.31.8. The key is the truncated SHA1 hash of the site URL, a fixed string and the time it was generated, and it is created the first time it is needed, which on sites without a key can be an unauthenticated request to the Zapier endpoint. This makes it possible for unauthenticated attackers to predict the key and use the Zapier endpoint to retrieve the bookings queued for the integration, including customer names, email addresses, phone numbers, addresses and notes, and to remove them from the queue. Bookings are queued whether or not Zapier is used. Version 10.31.9 generates random keys but keeps an existing key, so sites that generated a key with an earlier version should replace it.
References
- https://wpsec.com/vuln/WPSEC-2026-0429/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.9/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS