Salon Booking System CVE-2026-66453

Exploitation requires only network reachability to a WordPress site running the Salon Booking System plugin at version 10.30.26 or earlier, with the plugin's vulnerable endpoint active (the default state once the plugin is installed and booking is enabled). Per the CVSS vector PR:N and UI:N, no authentication and no user interaction are needed. The primary limiting factor is that the target site must actually have this specific plugin installed and enabled at a vulnerable version; the exact triggering feature/endpoint is not detailed in the available data, and the practical impact may be scoped to information disclosure per the Patchstack tag rather than full site compromise, so verify the concrete affected function against the vendor advisory.

The signals are largely aligned toward high priority in principle but incomplete in practice. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates fully remote, unauthenticated, low-complexity exploitation with high impact across all three security properties, which is the classic 9.8 profile. However, no EPSS score was provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced - so there is no evidence of active or automated exploitation at this time. There is also a mild tension in the data: the CVSS claims C:H/I:H/A:H (full compromise) while the Patchstack tag scopes the practical impact as 'Information Disclosure', suggesting the real-world outcome may be closer to unauthorized data access than full site takeover - verify the concrete impact against the Patchstack advisory before treating this as a full-compromise RCE-equivalent. Net: credible high-severity issue warranting prompt patching for any site running the plugin, but current real-world exploitation risk is unquantified due to missing EPSS and absent KEV/POC evidence.

A remote attacker with no account sends a crafted HTTP request directly to a Salon Booking System endpoint that fails to properly verify identity, causing the plugin to treat the request as an authorized user and return or modify booking/customer data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the WordPress site with no authentication and no victim interaction. No public POC is currently referenced, so exploitation would require the attacker to derive the specific vulnerable request.