What is the CVSS score of EUVD-2026-57873?

EUVD-2026-57873 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Salon Booking System are affected by EUVD-2026-57873?

The Salon Booking System WordPress plugin (version 10.30.26 and earlier) contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access protected booking data…

How to fix or mitigate EUVD-2026-57873?

Within 24 hours: conduct a complete audit of all WordPress installations to identify any running Salon Booking System plugin version 10.30.26 or earlier; immediately disable and deactivate the plugin if it is not actively required for business operations. Within 7 days: for sites where the plugin cannot be disabled, deploy Web Application Firewall rules and IP-based access controls to restrict booking endpoints and administrative interfaces to known internal networks only; implement rate limiting on booking and authentication endpoints; enable detailed logging and alerting for all unauthenticated access attempts. Within 30 days: verify patch availability status directly with plugin vendor; identify and evaluate replacement plugins with active security maintenance; deploy any security patch released for this plugin within 48 hours of vendor publication.

Salon Booking System EUVD-2026-57873

| CVE-2026-66453 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-13 Patchstack

GHSA-w4wg-6w3x-96hc

Information Disclosure Salon Booking System

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network endpoint with no user interaction justifies AV:N/AC:L/PR:N/UI:N; broken-auth data access supports C:H/I:H, but the Information Disclosure tag gives no clear availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:35 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

AnalysisAI

Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Salon Booking System

Delivery

Send crafted request to plugin endpoint

Exploit

Bypass broken authentication check (CWE-288)

Execution

Access protected booking/customer data

Impact

Disclose or manipulate sensitive information

Access

Identify WordPress site running Salon Booking System

Delivery

Send crafted request to plugin endpoint

Exploit

Bypass broken authentication check (CWE-288)

Execution

Access protected booking/customer data

Impact

Disclose or manipulate sensitive information

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network reachability to a WordPress site running the Salon Booking System plugin at version 10.30.26 or earlier, with the plugin's vulnerable endpoint active (the default state once the plugin is installed and booking is enabled). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are largely aligned toward high priority in principle but incomplete in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote attacker with no account sends a crafted HTTP request directly to a Salon Booking System endpoint that fails to properly verify identity, causing the plugin to treat the request as an authorized user and return or modify booking/customer data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the WordPress site with no authentication and no victim interaction. …
Remediation	No vendor-released patch version is identified in the available data; the input only confirms that versions up to and including 10.30.26 are affected, so administrators should upgrade to the latest Salon Booking System release available on WordPress.org that is newer than 10.30.26 and confirm it addresses this issue via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-30-26-broken-authentication-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: conduct a complete audit of all WordPress installations to identify any running Salon Booking System plugin version 10.30.26 or earlier; immediately disable and deactivate the plugin if it is not actively required for business operations. …

Threat intelligence, references, and detailed analysis are available after sign-in.