Decryption key:
Salon Booking - Wordpress Plugin v10.30.34
== Changelog ==
30.07.2026 - 10.30.34
* Security fix: enforced booking ownership on the single-booking REST endpoint to prevent authenticated users from reading other customers' booking details (IDOR) — thanks to Muni Nitish Kumar Yaddala
* Security fix: added nonce and secure per-booking token validation to the tip and discount AJAX actions to prevent unauthenticated tampering with bookings — thanks to Muni Nitish Kumar Yaddala
* Security fix: enforced the per-booking secure token on the booking wizard confirmation/summary steps to prevent unauthenticated disclosure of booking information — thanks to Usama Arshad
* Security fix: added OAuth state validation, an admin capability check and removal of the unauthenticated callback on the Google Calendar connection to prevent connection hijacking; removed the shared hardcoded OAuth credentials (each site must now configure its own) — thanks to Daniel Dhaniswara