The Salon Booking System plugin for WordPress has a missing capability check in its AJAX handler, allowing any unauthenticated user to trigger privileged actions. Through the vulnerable endpoint the attacker can perform limited file uploads and modify scheduling data. The flaw is classified as a missing authorization (CWE‑862).

Affected by this flaw is the WordPress plugin Salon Booking System – Free Version, all releases up to and including 10.22. The plugin is widely used for appointment scheduling in salons and spas, so every WordPress site running these versions is vulnerable.

The CVSS base score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% shows a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. Exploitation requires only an unauthenticated HTTP POST to the plugin’s AJAX endpoint, which is easily performed by any user with internet access. Once triggered, the attacker can upload files and modify booking data without authorization, potentially disrupting business operations.