TI-2022-00823 Aliases CVE-2022-0920 GHSA-9m85-v4hv-p2xv

Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

LOW 36CWE-863Published 2022-04-11 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data

Why it matters now

EPSS 0.01454 73rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Salon booking system (Unknown): 7.6.3Salon Booking System Pro (Unknown): 7.6.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Salon booking system	7.6.3 to before 7.6.3	7.6.3	Patch available	CNA
Unknown	Salon Booking System Pro	7.6.3 to before 7.6.3	7.6.3	Patch available	CNA

Salon booking system VendorUnknown Affected 7.6.3 to before 7.6.3 Fixed in 7.6.3 Patch available CNA
Salon Booking System Pro VendorUnknown Affected 7.6.3 to before 7.6.3 Fixed in 7.6.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:salonbookingsystem:salon_booking_system::::::wordpress::*	before 7.6.3	Vulnerable	Dimitri Grassi

cpe:2.3:a:salonbookingsystem:salon_booking_system:*:*:*:*:*:wordpress:*:* Versions before 7.6.3 Vulnerable ·Dimitri Grassi

Remediation

Fix · CNA Salon booking system (Unknown) Fixed in 7.6.3
Fix · CNA Salon Booking System Pro (Unknown) Fixed in 7.6.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-04-11
Salon Booking System Pro, Salon booking system 7.6.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-00822 Salon booking system < 7.6.3 - Unauthenticated Sensitive Data DisclosurePriority LOW 26
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-0920
2026-10-03 Alias added: GHSA-9m85-v4hv-p2xv

References

Exploit 1

https://wpscan.com/vulnerability/5a5ab7a8-be67-4f70-925c-9cb1eff2fbe0

TI-2024-01952 WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.7
TI-2024-09168 Salon Booking System < 10.9.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-01953 Salon booking system < 9.6.3 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 4.7
TI-2024-02257 Salon booking system <= 9.6.5 - Settings Update via CSRF CVSS 3.1MEDIUM 4.3
TI-2024-20234 WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
TI-2024-03027 Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences