The Salon Booking System WordPress plugin versions up to 10.30.33 contain an access control weakness (CWE-284) in the Google Calendar authorization callback. The callback does not verify user capabilities or validate the OAuth state parameter and is hooked for unauthenticated users. This allows an unauthenticated attacker to replace the legitimate Google Calendar tokens stored by the site with malicious tokens under the attacker's control. Successful exploitation requires the site to have set up its own Google OAuth client for calendar integration. No CVSS score or patch information is provided, and no known exploits are reported in the wild.

An attacker can hijack the Google Calendar integration by overwriting the site's stored OAuth tokens without authentication. This could lead to unauthorized access or manipulation of calendar data associated with the site. The impact is limited to sites that have configured their own Google OAuth client for the calendar feature. There is no indication of remote code execution or broader system compromise from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling the Google Calendar integration or restricting access to the authorization callback endpoint. Monitoring for unusual OAuth token changes may help detect exploitation attempts.