A flaw in the Salon Booking System WordPress plugin allows users with the custom salon staff role to assign arbitrary capabilities to other accounts when editing a customer. The vulnerability stems from a case-insensitive handling of a user meta key, which bypasses checks that normally restrict capability changes. An attacker can therefore elevate any account to site administrator and fully compromise the WordPress installation.

The vendor is unknown but the affected product is the Salon Booking System WordPress plugin. Any installation of the plugin on a WordPress site running a version earlier than 10.31.11 is vulnerable. The vulnerability is specific to the custom salon staff role defined by the plugin.

Because the attack only requires a user with salon staff privileges—which may not be highly privileged already—the barrier to exploitation is low. The plugin does not embed any additional authentication or network restrictions, making the attack possible from any web session a staff user can initiate. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the impact of full administrative takeover warrants a high urgency. The CVSS score is unspecified, but the flaw permits complete site compromise if exploited. The exploitability is high given the clear path to promotion to administrator.