# CVE-2026-11887: Salon Booking System WordPress plugin authorization bypass in AJAX action

Source: https://junglewise.ai/threats/cve-2026-11887-salon-booking-system-wordpress-plugin-authorization-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-11887 · Severity: info · CVSS 4.3 · Published 2026-07-01

The Salon Booking System plugin for WordPress, which manages appointments and customer bookings, contains a security flaw in its administrative settings. An attacker with a basic user account (such as a customer or subscriber) can change the plugin's configuration to automatically approve all new bookings. This could disrupt business operations by bypassing manual review processes and allowing unauthorized or unwanted appointments to be confirmed without staff oversight.

Technologies: [Salon Booking System](https://junglewise.ai/threats/technologies/salon-booking-system). Vendors: [Salon Booking System](https://junglewise.ai/threats/vendors/salon-booking-system).

## Quick answers

**Is CVE-2026-11887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11887 being exploited in the wild.

**How severe is CVE-2026-11887?** Informational severity, with a CVSS score of 4.3, published 1 July 2026.

**Which products and versions are affected?** Salon Booking System < 10.30.20.

**Is there a fix for CVE-2026-11887?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11887 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11887?** Check whether you run Salon Booking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Missing Authorization (CWE-862) issue within the Salon Booking System plugin's AJAX handling. Specifically, the 'salon' AJAX action with the 'SetDefaultBookingStatus' method does not verify if the requesting user has administrative privileges. An attacker authenticated as a low-level user (e.g., Subscriber) can send a crafted POST request to wp-admin/admin-ajax.php to change the default booking status to 'confirmed'. This allows the attacker to bypass the manual approval workflow intended for new bookings. The issue is resolved in version 10.30.20.

## Affected products

- Salon Booking System Salon Booking System < 10.30.20

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-07-01: other: NVD publication date

## References

- [https://wpscan.com/vulnerability/ed203765-0482-4d55-b36f-cdab11ed3cf0/](https://wpscan.com/vulnerability/ed203765-0482-4d55-b36f-cdab11ed3cf0/)

## Related threats

- [The Salon Booking System missing authorization in REST API endpoint](https://junglewise.ai/threats/cve-2026-110035-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin SSRF and stored XSS in image URL](https://junglewise.ai/threats/cve-2026-110033-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System WordPress plugin insufficient access control in customer editor](https://junglewise.ai/threats/cve-2026-110032-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System plugin privilege escalation](https://junglewise.ai/threats/cve-2026-110031-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin CSRF in REST API](https://junglewise.ai/threats/cve-2026-110015-the-salon-booking-system-wordpress-plugin-before-10-31-9-does)