Salon Booking System Pro CVE-2026-25334

WordPress installations with Salon Booking System Pro plugin versions before 10.30.12 installed and activated. Remote unauthenticated attacker; AC:H suggests specific non-default configuration or race condition required for privilege escalation.

While CVSS and EPSS scores are not provided, the vulnerability carries significant real-world risk based on available intelligence. The privilege escalation classification combined with account takeover implications indicates a high-impact vulnerability affecting a WordPress plugin in active use. Patchstack's documentation suggests this is a known and analyzed vulnerability with sufficient detail to warrant a security update, indicating moderate-to-high exploitability. The availability of a patched version (10.30.12) suggests the vulnerability was confirmed and reproducible by security researchers. Without explicit KEV status or POC confirmation in the provided data, the exploitation difficulty remains unclear, but privilege escalation vulnerabilities in WordPress plugins are frequently targeted in mass exploitation campaigns. The fact that a specific patch version exists (10.30.12) indicates this is not theoretical and represents an active security concern for all plugin installations below that version. Organizations running affected versions should treat this as a priority remediation item, particularly if the plugin manages sensitive customer data.

An unauthenticated attacker or a low-privileged user (such as a guest or customer account) could exploit the incorrect privilege assignment by directly calling booking system functions or API endpoints that lack proper capability verification. By crafting requests that bypass the plugin's role-checking logic, the attacker could escalate their privileges to administrator level, gaining control over the salon booking system, accessing customer personal data and payment information, modifying or deleting bookings, or creating rogue administrator accounts for persistent access. The account takeover aspect noted in the Patchstack reference suggests the vulnerability allows hijacking of legitimate administrative accounts or creation of unauthorized privileged accounts within the WordPress system.