What is the CVSS score of CVE-2026-42666?

CVE-2026-42666 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Salon Booking System are affected by CVE-2026-42666?

The Salon Booking System WordPress plugin contains a critical vulnerability allowing unauthorized access to customer booking records and personal information without authentication, exposing salon…

How to fix or mitigate CVE-2026-42666?

Within 24 hours: Identify all WordPress instances running Salon Booking System plugin and document current versions; enable detailed access logging on affected systems. Within 7 days: Deploy Web Application Firewall rules to restrict unauthorized information access patterns; review 30-day logs for exploitation indicators; contact vendor and Patchstack for patch availability and timeline. Within 30 days: Deploy patched version immediately upon release; conduct customer notification procedures and incident review; evaluate alternative booking plugins if patch timeline exceeds organizational risk tolerance.

Salon Booking System CVE-2026-42666

EUVD-2026-36831 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-rpf2-jr33-p9h9

Authentication Bypass Salon Booking System

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Plugin endpoint is network-reachable, requires no auth or interaction, and missing authorization yields data disclosure only - no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:58 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.

AnalysisAI

Unauthenticated information disclosure in the Salon Booking System WordPress plugin (versions up to and including 10.30.25) allows remote attackers to bypass authorization checks and access sensitive data without credentials. The flaw, tracked by Patchstack and tagged as an authentication bypass, is network-reachable with low complexity and no user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Salon Booking System is a WordPress plugin (CPE cpe:2.3:a:dimitri_grassi:salon_booking_system) authored by Dimitri Grassi that provides appointment scheduling, customer management, and booking workflows for salon businesses. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints (typically REST routes, AJAX handlers, or admin-post actions in WordPress plugins) fail to verify the caller's permissions before returning data or performing an action. Because WordPress exposes these handlers over standard HTTP without requiring authentication when the capability check is missing, any unauthenticated visitor reaching the site can invoke the affected functionality directly.

RemediationAI

Patch status is not explicitly stated in the provided data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-30-25-broken-access-control-vulnerability for the fixed version and upgrade to any release after 10.30.25 via the WordPress plugin dashboard. Until upgrade is possible, compensating controls include deploying a WordPress WAF rule (Patchstack, Wordfence, or equivalent) to block unauthenticated requests to the plugin's REST and admin-ajax endpoints - accepting the trade-off that legitimate booking flows from anonymous customers may be impacted and should be tested. Alternatively, deactivate the plugin entirely on sites where bookings are non-critical, which eliminates the exposure but removes booking functionality, or restrict access to /wp-admin/admin-ajax.php and /wp-json/ paths used by the plugin via IP allowlisting at the reverse proxy where customer-facing booking is not required.