The Salon Booking System WordPress plugin before version 10.31.9 fails to verify the authenticity of REST API requests and ignores WordPress core nonce checks for cookie‑authenticated sessions, enabling an attacker to trick a logged‑in administrator into clicking a crafted link. The attacker can then forge authenticated requests that create a new administrator account, escalating privileges and granting full control of the site.

WordPress sites running the Salon Booking System plugin earlier than 10.31.9 are affected. These sites rely on the plugin to manage salon appointments and bookings, and administrators using the plugin are at risk.

The vulnerability scores 8.8 on the CVSS scale, indicating high severity. However, the EPSS score is less than 1%, suggesting a low but non-zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Attackers must exploit social engineering to get an administrator to click a malicious link, indicating a manual rather than automated attack vector. While the potential impact is severe, the low EPSS score reflects limited real‑world exploitation to date.