{"id":"CVE-2022-0920","aliases":["EUVD-2022-15947","GHSA-9m85-v4hv-p2xv"],"status":"published","title":"Salon booking system \u003c 7.6.3 - Customer+ Bookings/Customers Data Disclosure","description":"The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01454,"percentile":0.73659,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2022-04-11T14:40:58Z","modified":"2026-06-17T04:21:29Z","products":[{"vendor":"dimitri grassi","product":"salon booking system"},{"vendor":"salonbookingsystem","product":"salon_booking_system"},{"vendor":"unknown","product":"salon booking system"},{"vendor":"unknown","product":"salon booking system pro"},{"vendor":"wordpresschef","product":"salon booking system pro"}],"references":[{"url":"https://wpscan.com/vulnerability/5a5ab7a8-be67-4f70-925c-9cb1eff2fbe0","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0920"},{"url":"https://github.com/advisories/GHSA-9m85-v4hv-p2xv"}],"sources":{"cve":[{"id":"CVE-2022-0920","title":"Salon booking system \u003c 7.6.3 - Customer+ Bookings/Customers Data Disclosure","description":"The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data","status":"published","published":"2022-04-11T14:40:58Z","modified":"2024-08-02T23:47:42.834Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15947","description":"The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data","status":"published","published":"2022-04-11T14:40:58Z","modified":"2024-08-02T23:47:42Z","updated_at":"2026-11-03T03:26:03.022972Z"}],"ghsa":[{"id":"GHSA-9m85-v4hv-p2xv","title":"The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper...","description":"The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data","status":"published","published":"2022-04-12T00:00:35Z","modified":"2023-01-27T05:01:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:56.851256Z"}],"nvd":[{"id":"CVE-2022-0920","description":"The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data","status":"published","published":"2022-04-11T15:15:08.737Z","modified":"2026-06-17T04:21:29.263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:15.414503Z"}]}}