The vulnerability allows an attacker to elevate privileges within the Salon booking system WordPress plugin without prior authentication. By exploiting this flaw, an attacker can obtain administrator or higher-level permissions, enabling full control over the WordPress site, modification of data, changes to configurations, and potential compromise of other plugins or core functions. It stems from an improper restriction of privileged access, as identified by CWE-266.

The issue affects the Salon booking system plugin for WordPress, developed by Dimitri Grassi. All releases up to and including version 10.31.7 are vulnerable; newer releases (10.31.9 and later) contain the fix.

With a CVSS score of 8.8, this moderate to high severity flaw carries significant risk. The EPSS score is reported as less than 1%, indicating low but nonzero current exploitation probability, while the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based, targeting exposed plugin endpoints that lack proper authentication checks. An attacker does not need prior credentials, so the exploit path is straightforward for anyone who can reach the site's front-end or internal network. Applying the patch removes the vulnerability.