EUVD-2026-40921
GHSA-q6pc-8fwh-45m2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L confirmed by subscriber-level requirement; I:L reflects settings modification only; C:N and A:N because no data exposure or denial of service occurs.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.
AnalysisAI
Missing authorization on an AJAX endpoint in the Salon Booking System WordPress plugin (all versions before 10.30.20) allows any authenticated subscriber-level user to modify plugin settings and disable the manual approval workflow for new bookings. A publicly available proof-of-concept exists per WPScan's disclosure, making exploitation straightforward for any registered user on affected sites. No public exploitation (CISA KEV) has been confirmed, and SSVC assessment classifies technical impact as partial with exploitation not yet automated.
Technical ContextAI
The Salon Booking System is a WordPress plugin that manages salon appointments, including a manual approval gate for new bookings. WordPress plugins register AJAX handlers via wp_ajax_ and wp_ajax_nopriv_ hooks; when a handler omits a capability check (e.g., current_user_can()) or nonce validation, any authenticated session can invoke it. In this case, at least one AJAX action lacks proper authorization, meaning the WordPress role/capability system is bypassed entirely for that endpoint. The affected CPE is cpe:2.3:a:unknown:salon_booking_system:*:*:*:*:*:*:*:* covering all versions before 10.30.20. Although the CWE field is listed as N/A in the source data, the root cause maps to CWE-862 (Missing Authorization) - a class of flaw where a function is reachable by principals with insufficient privilege because no capability gate exists on the server side.
RemediationAI
Vendor-released patch: 10.30.20. WordPress site administrators should update the Salon Booking System plugin to version 10.30.20 or later via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. If immediate patching is not feasible, a compensating control is to disable new user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which removes the subscriber account creation vector and prevents unauthenticated visitors from obtaining the credential needed to trigger the AJAX action - this trade-off blocks legitimate registrations as well. Alternatively, a WAF rule blocking unauthenticated or subscriber-role AJAX requests to the specific wp-admin/admin-ajax.php endpoint handling the vulnerable action can reduce exposure while a maintenance window is scheduled. References: WPScan disclosure at https://wpscan.com/vulnerability/ed203765-0482-4d55-b36f-cdab11ed3cf0/ and VulDB advisory at https://vuldb.com/vuln/375368.
More in Salon Booking System
View allThe Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and includ
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) expose
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its end
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a
Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.5. Rated crit
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when b
Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthe
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field wh
Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote vis
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching boo
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Sal
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today