A Cross‑Site Request Forgery flaw exists in the Salon booking system plugin before version 10.30.3 that allows an attacker to trick an authenticated user into submitting a request that the site will accept as legitimate. The vulnerability can be abused to perform any action that the victim user is authorized to execute, potentially altering booking data or exposing sensitive information. The weakness is a classic CSRF defect (CWE‑352).

Vendors affected are Dimitri Grassi: Salon booking system plugin. All released versions up through and including 10.30.3 are vulnerable, with no earlier version mentioned as fixed.

The CVSS score of 4.3 indicates moderate severity; however, the EPSS score is less than 1%, showing the chance of exploitation is very low and it is not listed in CISA’s KEV catalog. Typical exploitation would require the victim to be logged into the site and would involve the attacker sending a crafted HTTP request, often via a malicious link or form. No special conditions beyond user authentication are stated, so the attack vector is inferred to be user‑initiated web traffic. The attacker can thereby execute unintended actions with the victim’s privileges.