Executive brief
The Salon Booking System plugin for WordPress, which manages appointments and customer bookings, contains a security flaw in its administrative settings. An attacker with a basic user account (such as a customer or subscriber) can change the plugin's configuration to automatically approve all new bookings. This could disrupt business operations by bypassing manual review processes and allowing unauthorized or unwanted appointments to be confirmed without staff oversight.
Technical details
The vulnerability is a Missing Authorization (CWE-862) issue within the Salon Booking System plugin's AJAX handling. Specifically, the 'salon' AJAX action with the 'SetDefaultBookingStatus' method does not verify if the requesting user has administrative privileges. An attacker authenticated as a low-level user (e.g., Subscriber) can send a crafted POST request to wp-admin/admin-ajax.php to change the default booking status to 'confirmed'. This allows the attacker to bypass the manual approval workflow intended for new bookings. The issue is resolved in version 10.30.20.
Affected products
- Salon Booking System Salon Booking System < 10.30.20
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-07-01: other: NVD publication date