CVE-2026-40768: WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability

Synopsis

An Insecure Direct Object Reference (IDOR) vulnerability affects the Salon booking system WordPress plugin at version 10.30.24 and earlier. The flaw is reachable over the network without any authentication, meaning any internet user can send crafted requests directly to the plugin's endpoints. Successful exploitation gives an attacker limited read access, limited write access, and limited ability to disrupt the service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS from any internet-accessible location.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerability is exploitable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is executed entirely by the attacker against the server.

• Attack complexityDetail

  Exploitation is straightforward and condition-free, requiring no race conditions, special memory layout, or environmental setup.

Blast Radius

• Reads booking records, customer names, appointment details, or other data objects the plugin manages by enumerating predictable object identifiers.
• Modifies or overwrites booking records or plugin-managed data objects belonging to other users.
• Causes limited disruption to the booking service, such as canceling or corrupting reservations.