Salon Booking System EUVD-2026-103392

Exploitation requires the attacker to be authenticated and to hold the Salon Booking System plugin's custom 'salon staff' role; the flaw is triggered through the plugin's customer-editing function, which fails to restrict capability assignment, letting staff grant arbitrary (including administrator) capabilities. Limiting factors: this is not reachable by anonymous visitors or ordinary subscribers - it needs a provisioned staff account, so realistic risk depends on how freely staff roles are handed out and on those accounts' password/MFA hygiene. Affected deployments run Salon Booking System from 10.17 up to (but not including) 10.31.11.

This is a credible but access-gated privilege-escalation flaw (CWE-269) rather than an internet-wide spray target. The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the description agree that exploitation requires an already-authenticated actor holding the plugin's custom 'salon staff' role - there is no unauthenticated path, so PR is the dominant limiting metric. Note a judgment disagreement: NVD/WPScan scored this PR:H, but the salon staff role is a limited, non-administrative role, so PR:L is arguably more accurate (raising the realistic base score); either way the signal is 'requires a valid privileged plugin account.' Technical impact is total - the attacker promotes any account, including their own, to administrator and takes over the site, hence C:H/I:H/A:H. Publicly available exploit code exists (WPScan), which raises the practical likelihood for environments that grant staff accounts to semi-trusted employees or that have weak staff-account hygiene. No EPSS score, SSVC decision, or CISA KEV status was provided in the input; absence of KEV means there is no confirmation of active exploitation, so this should be treated as a high-value insider/compromised-account escalation to patch promptly rather than an emergency perimeter CVE.

An attacker who has been granted (or has compromised) a salon staff account logs into the WordPress site and opens the plugin's customer-editing screen. Because the plugin fails to restrict which capabilities a staff user may assign, the attacker assigns administrator capabilities to an account they control and gains full site control. Public exploit code for this flow is available via WPScan, lowering the skill required.