Salon Booking System CVE-2026-40768

The target WordPress site must have the Salon Booking System plugin (by Dimitri Grassi) installed and active at version 10.30.24 or earlier, with the vulnerable booking-object endpoint reachable over the network - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and no special configuration is required beyond a default deployment. Exploitation is limited by the need to know or guess valid object identifiers (booking IDs/tokens) and by the Low C/I/A impact scope, meaning each successful request affects only the referenced booking record rather than the whole site.

The signals are mixed-to-moderate: CVSS 3.1 base 7.3 (AV:N/AC:L/PR:N/UI:N) makes this trivially reachable over the network with no authentication or user interaction, but the impact metrics are only Low across C/I/A, suggesting bounded per-record exposure rather than full takeover. No EPSS score, KEV listing, or public POC was supplied, so there is no public exploit identified at time of analysis, and the SSVC dimensions (automatable, technical impact) are not provided in the input. The realistic priority is elevated for sites running this plugin because IDOR flaws are commonly automated against WordPress plugin endpoints once the vulnerable parameter is known, but in the absence of KEV/POC/EPSS data it should be treated as a near-term patching priority rather than an emergency.

An unauthenticated attacker enumerates sequential or guessable booking identifiers against a public Salon Booking System endpoint on a target WordPress site and submits requests that reference another customer's booking ID. Because authorization is not enforced against the supplied identifier, the attacker reads or modifies bookings belonging to other customers (e.g., viewing personal details, cancelling appointments, or altering reservation data). No public exploit was identified at time of analysis, but IDOR enumeration is straightforward to script with standard HTTP tooling.