Salon Booking System

Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. No public exploit has reached CISA KEV status, but a publicly available proof-of-concept was published by WPScan, and EPSS remains low at 0.14% (3rd percentile), consistent with a niche plugin requiring a non-default configuration. The primary consequence is persistent integrity and availability disruption of the booking-calendar workflow, with a secondary confidentiality risk if future appointment data is synced to the attacker's Google account.

Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.

Unauthenticated price manipulation in the Salon Booking System WordPress plugin (through 10.30.33) allows any remote visitor to tamper with the stored total of arbitrary bookings by invoking unprotected booking-modification AJAX endpoints. The plugin neither restricts access to these actions nor verifies that the requesting user owns the targeted booking, creating a CWE-862 missing-authorization flaw. No public exploitation in CISA KEV has been confirmed, though a publicly available proof-of-concept exists via WPScan, and EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic rather than widespread active exploitation.

Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. A publicly available proof-of-concept exists per WPScan disclosure; no active exploitation has been confirmed in CISA KEV at time of analysis.

Missing authorization on an AJAX endpoint in the Salon Booking System WordPress plugin (all versions before 10.30.20) allows any authenticated subscriber-level user to modify plugin settings and disable the manual approval workflow for new bookings. A publicly available proof-of-concept exists per WPScan's disclosure, making exploitation straightforward for any registered user on affected sites. No public exploitation (CISA KEV) has been confirmed, and SSVC assessment classifies technical impact as partial with exploitation not yet automated.

Unauthenticated Insecure Direct Object Reference in the Salon Booking System WordPress plugin (versions <= 10.30.24) allows remote attackers to access or manipulate booking objects belonging to other users by tampering with object identifiers in requests. The flaw was reported by Patchstack and affects the dimitri_grassi salon_booking_system plugin per the provided CPE, with no public exploit identified at time of analysis.

Unauthenticated information disclosure in the Salon Booking System WordPress plugin (versions up to and including 10.30.25) allows remote attackers to bypass authorization checks and access sensitive data without credentials. The flaw, tracked by Patchstack and tagged as an authentication bypass, is network-reachable with low complexity and no user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.7. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.8.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.9. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.

The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 33.7%.

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.