Salon Booking System EUVD-2026-103393

Requires an authenticated account holding the plugin's Salon Staff or Salon Worker role on a site running Salon Booking System before 10.31.11; exploitation is performed through the plugin's customers management screen, which fails to restrict which user account a staff role may edit. No victim user interaction is needed (UI:N). Limiting factors: the attacker must already possess one of these staff/worker roles (not an anonymous or default visitor), the site must have multiple user accounts/roles provisioned, and the vulnerable plugin version must be installed and active - so this is realistically an insider or compromised-staff-credential scenario rather than unauthenticated remote takeover.

This is a medium-severity (CVSS 5.5) broken-access-control/authorization flaw (CWE-863), and the real-world risk is moderate and insider-driven rather than broad. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L indicates a network-reachable, low-complexity attack requiring privileges and no user interaction, with high integrity impact and low availability impact. Publicly available exploit code exists (WPScan), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of widespread automated exploitation. A key conflict must be stated explicitly: the CVSS vector encodes PR:H, yet the description identifies the abusing accounts as the 'Salon Staff' or 'Salon Worker' roles - these are relatively low-privilege operational roles, not administrators, so PR:L is the more defensible reading; verify role privilege level with the vendor/WPScan advisory. Net assessment: a genuine privilege-escalation/account-takeover issue that can lock out administrators, but exploitation is gated on already holding a staff/worker account on a multi-user salon site, so it is a targeted insider-abuse risk rather than a high-urgency internet-wide threat. EPSS absence and no KEV argue against treating this as an emergency, while POC availability plus high integrity impact argue for prompt patching on affected sites.

A user who already holds a Salon Staff or Salon Worker account (a receptionist, worker, or a disgruntled/compromised staff login) opens the plugin's customers management screen and edits an administrator's account instead of a customer's, resetting the admin's role to 'customer' and overwriting arbitrary profile fields. This demotes all administrators, causing loss of administrative access and potential full site lockout. Publicly available exploit/write-up exists via WPScan.