Salon Booking System – Free Version <= 10.31.3 – Unauthenticated Google Calendar Connection Hijack via OAuth Callback | CVE 2026-17023

Description

The plugin does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

Proof of Concept

Salon Booking System – Free Version <= 10.30.33: unauthenticated Google Calendar connection hijack via the OAuth callback.

Prerequisites (real-world exploit conditions):
- The target site has configured the plugin's Google Calendar feature with its own Google OAuth client (Salon settings > Google Calendar: Client ID, Client Secret, Redirect URI) and enabled Google Calendar sync. This is the intended, documented setup for the feature.
- The attacker knows the site's OAuth Client ID and has completed Google's own consent screen, with their own Google account, against that client using the site's registered redirect URI (https://victim.example/wp-admin/admin-ajax.php?action=googleoauth-callback), yielding a valid, unexpired authorization code.

Exploit:
1. As a fully unauthenticated visitor (no cookies, no login), request:
     GET https://victim.example/wp-admin/admin-ajax.php?action=googleoauth-callback&code=<ATTACKER_CODE>
2. The callback exchanges the code for tokens using the site's own OAuth client credentials and persists them into the site-wide salon settings (sln_access_token / sln_refresh_token), with no state, nonce, or capability check. The site's Google Calendar connection is now bound to the attacker's tokens, severing the owner's integration.

Result: the site-wide Google Calendar tokens are overwritten by a single unauthenticated request; the legitimate owner's calendar connection is replaced/broken.