Skip to main content

Salon Booking System CVE-2026-81793

| EUVDEUVD-2026-75524 MEDIUM
Missing Authorization (CWE-862)
2026-09-10 Patchstack GHSA-gw22-qq43-pp8h
WordPress Authentication Bypass Salon Booking System Wordpress Plugin Dimitri Grassi
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
6.5 MEDIUM

Unauthenticated network exploitation confirmed by PR:N; limited to partial integrity and availability impact with no confidentiality loss per description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Sep 10, 2026 - 15:16 vuln.today
CVE Published
Sep 10, 2026 - 14:23 cve.org
MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Salon booking system <= 10.31.5 versions.

AnalysisAI

Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target WordPress site must have the Salon Booking System plugin installed, active, and running version 10.31.5 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Salon Booking System plugin to a version beyond 10.31.5; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-31-4-broken-access-control-vulnerability for the confirmed fixed release, as no specific patched version is disclosed in currently available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Salon Booking System

View all
CVE-2024-4442 CRITICAL
9.1 May 21

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and includ
CVE-2024-3229 CRITICAL
9.8 Jun 19

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio
CVE-2026-17022 HIGH POC
7.5 Aug 10

Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) expose
CVE-2022-0920 HIGH POC
7.5 Apr 11

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its end
CVE-2024-2603 MEDIUM POC
6.3 Apr 26

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a
CVE-2024-30510 CRITICAL
10.0 Mar 29

Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.5. Rated crit
CVE-2021-24429 MEDIUM POC
6.1 Jul 12

The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when b
CVE-2026-66453 CRITICAL
9.8 Aug 13

Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthe
CVE-2024-2101 MEDIUM POC
5.7 Apr 17

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field wh
CVE-2026-17021 MEDIUM POC
5.3 Aug 10

Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote vis
CVE-2022-0919 MEDIUM POC
5.3 Apr 11

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching boo
CVE-2024-37231 CRITICAL
9.1 Jun 24

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Sal

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-81793 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy