TI-2022-00822 Aliases CVE-2022-0919 GHSA-f42x-wf47-246q

Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure

LOW 26CWE-862Published 2022-04-11 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.

Why it matters now

EPSS 0.01164 67th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Salon booking system (Unknown): 7.6.3Salon Booking System Pro (Unknown): 7.6.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Salon booking system	7.6.3 to before 7.6.3	7.6.3	Patch available	CNA
Unknown	Salon Booking System Pro	7.6.3 to before 7.6.3	7.6.3	Patch available	CNA

Salon booking system VendorUnknown Affected 7.6.3 to before 7.6.3 Fixed in 7.6.3 Patch available CNA
Salon Booking System Pro VendorUnknown Affected 7.6.3 to before 7.6.3 Fixed in 7.6.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:salonbookingsystem:salon_booking_system::::::wordpress::*	before 7.6.3	Vulnerable	Dimitri Grassi

cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:* Versions before 7.6.3 Vulnerable ·Dimitri Grassi

Remediation

Fix · CNA Salon booking system (Unknown) Fixed in 7.6.3
Fix · CNA Salon Booking System Pro (Unknown) Fixed in 7.6.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-04-11
Salon Booking System Pro, Salon booking system 7.6.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-00823 Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data DisclosurePriority LOW 36
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-0919
2026-10-03 Alias added: GHSA-f42x-wf47-246q

References

Exploit 1

https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4

TI-2024-01952 WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.7
TI-2024-09168 Salon Booking System < 10.9.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-01953 Salon booking system < 9.6.3 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 4.7
TI-2024-02257 Salon booking system <= 9.6.5 - Settings Update via CSRF CVSS 3.1MEDIUM 4.3
TI-2024-20234 WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
TI-2024-03027 Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences