Salon Booking System CVE-2026-42666

No special conditions - remote unauthenticated exploitation against default configurations of the Salon Booking System WordPress plugin at version 10.30.25 or earlier, reachable over standard HTTP/HTTPS, with no user interaction and no authentication required (CVSS AV:N/AC:L/PR:N/UI:N). The only limiting factor is that the target WordPress site must have the plugin installed and activated at a vulnerable version; impact is bounded to confidentiality (C:H, I:N, A:N), so exploitation yields data disclosure rather than site modification or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a remote, unauthenticated, low-complexity flaw with high confidentiality impact but no integrity or availability impact, yielding a base score of 7.5 - consistent with sensitive data exposure rather than full takeover. EPSS, KEV status, and SSVC data were not provided in the input, so probability of mass exploitation cannot be quantified from the available signals. No public exploit identified at time of analysis, but WordPress plugin broken-access-control bugs are routinely automated by opportunistic scanners once advisory details are public, so the realistic risk for exposed sites is meaningful even absent confirmed exploitation. Defenders should treat this as a priority patch for any site running the plugin, while recognizing that the impact is limited to data disclosure rather than site compromise.

An attacker scans the internet for WordPress sites running Salon Booking System 10.30.25 or earlier, then issues crafted unauthenticated HTTP requests directly to the plugin's vulnerable endpoint to retrieve sensitive booking, customer, or configuration data. Because no authentication, user interaction, or unusual configuration is required, the request can be automated at scale by commodity scanners, and harvested customer PII could feed downstream phishing or fraud campaigns.