Salon booking system <= 10.31.8 - Unauthenticated Sensitive Information Exposure via PWA index.html Access Token
- ID
- WPSEC-2026-0430
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- from 8.4.4 before 10.31.9
- Remediation
- Update to 10.31.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-538
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Salon booking system on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 8.4.4 through 10.31.8 due to the plugin writing the REST API access token of the administrator or staff member who opens its PWA staff app page into the static file src/SLB_PWA/pwa/dist/index.html, which is publicly accessible under the plugin directory. Tokens issued by these versions do not expire. This makes it possible for unauthenticated attackers to retrieve that user's access token, once the PWA page has been opened, and use it to authenticate to the plugin's REST API as that user and, in versions 10.30.14 and later, to WordPress core REST API endpoints as well, which can lead to full site compromise when the token belongs to an administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-0430/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.9/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS