Salon Booking System EUVD-2026-102694

Exploitation requires that a user with an active, cookie-authenticated WordPress administrator session be tricked (UI:R) into clicking an attacker-crafted link or visiting a malicious page while logged in - the attacker needs no account of their own. The core enabling defect is that the plugin fails to verify REST API request authenticity and specifically discards WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version (<10.31.9) installed. Limiting factors: the victim must be an authenticated administrator and must perform the interaction (click/visit) while their session is live; there is no purely passive or unauthenticated-without-a-victim path, which materially constrains mass exploitation.

This is a CWE-352 Cross-Site Request Forgery flaw in the Salon Booking System WordPress plugin (<10.31.9) that the vendor rates CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The signals are mixed: the high CVSS reflects that a successful forge can create a new administrator account (full C/I/A compromise of the site), and publicly available exploit code exists (reported by WPScan), yet the EPSS score is only 0.11% (1st percentile) and the vulnerability is NOT in CISA KEV, indicating no confirmed mass exploitation. The low EPSS is consistent with the attack model: although the CVSS marks PR:N (the attacker needs no credentials of their own), UI:R means exploitation hinges on social-engineering a logged-in administrator into clicking a crafted link, which caps real-world weaponizability versus a drive-by RCE. Net assessment: this is a genuine privilege-escalation-to-admin risk that should be patched promptly on affected sites, but it is not an indiscriminately-wormable, actively-exploited emergency - the realistic threat is targeted phishing of admins rather than automated mass compromise. No key signals conflict with the description; the CVSS vector is self-consistent with a CSRF chain.

An attacker crafts a malicious web page or link embedding a forged REST API request to a vulnerable Salon Booking System site and lures an authenticated WordPress administrator into visiting it. Because the plugin discards WordPress core's nonce check for cookie-authenticated REST sessions, the victim's browser silently submits the request with the admin's session cookie, creating a new attacker-controlled administrator account. Publicly available exploit code (WPScan) demonstrates the request, lowering the bar for reuse.