Missing authorization within the Salon booking system plugin permits an attacker to perform operations beyond the intended permissions. The flaw stems from incorrectly configured access control security levels, enabling unauthorized viewing, modification, or deletion of booking data. This weakness resides in CWE‑862 and can compromise the confidentiality, integrity, and availability of the booking information.

The vulnerability affects the Salon booking system plugin developed by Dimitri Grassi, available as a WordPress plugin. All releases up to and including version 10.30.23 are affected. The plugin is installed on WordPress sites that incorporate this booking functionality.

The CVSS score of 5.4 indicates a moderate impact. The EPSS score of less than 1 % suggests a low likelihood that the vulnerability is actively exploited. The issue is not listed in the CISA KEV catalog. Attackers most likely need access to the WordPress administrative interface or an account with sufficient privileges to interact with the plugin’s management endpoints; this inference is based on the description of an access‑control weakness, but the exact authentication requirements are not explicitly detailed in the advisory.