# CVE-2026-81793: Salon Booking System broken access control vulnerability

Source: https://junglewise.ai/threats/cve-2026-81793-salon-booking-system-broken-access-control-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81793 · Severity: medium · CVSS 6.5 · Published 2026-09-10

The Salon Booking System is a WordPress plugin used to manage appointment reservations for salons and service businesses. A flaw in the plugin allows unauthenticated attackers to bypass access controls and view or perform actions on booking records they should not have permission to access, potentially exposing customer data and enabling unauthorized modifications to appointments.

Technologies: [Salon Booking System](https://junglewise.ai/threats/technologies/salon-booking-system). Vendors: [Salon Booking System](https://junglewise.ai/threats/vendors/salon-booking-system).

## Quick answers

**Is CVE-2026-81793 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81793 being exploited in the wild.

**How severe is CVE-2026-81793?** Medium severity, with a CVSS score of 6.5, published 10 September 2026.

**Which products and versions are affected?** Salon Booking System <= 10.31.6.

**Is there a fix for CVE-2026-81793?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81793 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81793?** Check whether you run Salon Booking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control flaw in the Salon Booking System WordPress plugin affecting versions up to 10.31.6. The issue allows unauthenticated users to access sensitive pages and perform unauthorized actions on booking data without proper authentication or authorization checks. No authentication is required to exploit this vulnerability, making it accessible over the network. An attacker can view other users' booking information, customer details, and potentially modify or cancel appointments. No official patch is currently available according to the advisory, though updating to a version beyond 10.31.6 (if available) is recommended.

## Affected products

- Salon Booking System Salon Booking System <= 10.31.6

## Timeline

- 2026-09-08: disclosed
- 2026-09-10: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-31-4-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-31-4-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [The Salon Booking System missing authorization in REST API endpoint](https://junglewise.ai/threats/cve-2026-110035-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin SSRF and stored XSS in image URL](https://junglewise.ai/threats/cve-2026-110033-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System WordPress plugin insufficient access control in customer editor](https://junglewise.ai/threats/cve-2026-110032-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System plugin privilege escalation](https://junglewise.ai/threats/cve-2026-110031-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin CSRF in REST API](https://junglewise.ai/threats/cve-2026-110015-the-salon-booking-system-wordpress-plugin-before-10-31-9-does)