The Salon Booking System WordPress plugin versions up to and including 10.30.33 contain an improper access control vulnerability (CWE-284) in the Google Calendar authorization callback. The callback does not verify user capabilities or validate the OAuth state parameter and is accessible to unauthenticated users. This allows attackers to replace the legitimate Google Calendar tokens stored by the site with malicious tokens under their control, effectively hijacking the integration. Successful exploitation depends on the site having configured its own Google OAuth client for the calendar feature.

An unauthenticated attacker can overwrite the Google Calendar connection tokens stored by the vulnerable plugin, leading to hijacking of the calendar integration. This can result in limited integrity and availability impact on the calendar functionality. There is no direct confidentiality impact reported. The attack requires the site to have configured its own Google OAuth client, which limits the scope of affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Google Calendar authorization callback endpoint if possible and monitor for suspicious activity related to OAuth token changes. Avoid configuring a custom Google OAuth client for the calendar feature if not necessary.