Missing Authorization vulnerability in the Dimitri Grassi Salon booking system plugin allows exploitation of incorrectly configured access control security levels. This flaw enables attackers to bypass intended permission checks, giving them unauthorized viewing, modification, or deletion of booking data. The weakness is identified as CWE‑862 and can compromise the confidentiality, integrity, and availability of booking information.

The vulnerability affects the Salon booking system plugin developed by Dimitri Grassi, available as a WordPress plugin. All releases up to and including version 10.31.9 are affected. The plugin is installed on WordPress sites that incorporate this booking functionality.

The CVSS score of 5.4 indicates a moderate impact. The EPSS score of less than 1 % suggests a low likelihood that the vulnerability is actively exploited. The issue is not listed in the CISA KEV catalog. Attackers most likely need access to the WordPress administrative interface or an account with sufficient privileges to interact with the plugin’s management endpoints; this inference is based on the description that the flaw stems from incorrectly configured access control security levels.