Salon Booking System EUVD-2026-55006

No authentication is required - the CVSS vector PR:N confirms unauthenticated access. The attacker needs network access to the target WordPress site's AJAX endpoint (wp-admin/admin-ajax.php), which is standard and publicly accessible on all WordPress installations. The plugin must be installed and active. The attacker must supply a valid booking identifier, which may require enumeration or prior access to a booking confirmation. No special platform, configuration flag, or user interaction is required. Exploitation is limited to integrity tampering of booking financial totals; there is no code execution, data exfiltration, or availability impact.

The CVSS 3.1 base score of 5.3 (Medium) reflects the network-accessible, unauthenticated, zero-interaction nature of the flaw (AV:N/AC:L/PR:N/UI:N) but correctly caps impact at I:L given the constrained scope - only booking totals are writable, not arbitrary data or system files. EPSS of 0.14% at the 3rd percentile is notably low despite a public PoC, indicating the security community has not observed widespread scanning or exploitation patterns targeting this plugin. This is not listed in CISA KEV, so confirmed active exploitation is absent. In practice, this vulnerability is real and trivially exploitable (PoC is public, no complexity required), but its real-world business impact is limited to price-tampering within a niche salon-management plugin rather than data exfiltration or system compromise. Organizations running salon booking sites with this plugin should treat it as a meaningful integrity risk - particularly where bookings translate directly to revenue - while recognizing it does not present the lateral-movement or data-breach risk of higher-impact classes.

An attacker visits a WordPress salon booking site, identifies a target booking ID through enumeration or prior knowledge (e.g., from a legitimate booking confirmation), and sends a crafted unauthenticated AJAX POST request to wp-admin/admin-ajax.php specifying the target booking and a modified total amount. A publicly available PoC from WPScan details the exact action name and parameters. The booking record is updated server-side with the attacker-supplied total, potentially allowing the attacker to pay a reduced price for services.