The Salon Booking System WordPress plugin fails to verify authorization before allowing booking creation. As a result, any actor can construct a request that assigns a custom user identifier and booking status, causing the system to create bookings false‑tied to legitimate users, overwrite their stored contact information, and mark bookings as paid or confirmed without actual payment. This flaw enables administrative impersonation, data tampering, and financial misrepresentation.

Unknown WordPress sites running the Salon Booking System plugin, any version earlier than 10.31.9. The vulnerability applies to all installations that have this plugin enabled and accept booking creation requests without authentication.

Attackers can trigger it by sending crafted HTTP requests to the booking creation endpoint from any network location that can reach the WordPress site. No authentication is required and the attack can be performed remotely with minimal skill. The EPSS score < 1% and the CVSS score of 5.3 indicate moderate severity; the issue is not listed in CISA KEV. The moderate CVSS score coupled with a very low EPSS suggests a low to moderate exploitation risk. Monitoring for anomalous booking activity is recommended until a fix is applied.