The Salon Booking System WordPress plugin before 10.31.11 implements a role management interface that is not properly gated; users with Salon Staff or Salon Worker roles can edit the roles of any other user through the customer editing screen. This flaw enables an attacker to downgrade an administrator to a customer role, modify arbitrary profile fields, and effectively remove administrative control from the site, potentially locking the site from legitimate administrators.

All installations of the Salon Booking System WordPress plugin with versions earlier than 10.31.11. The vulnerability is contained to this plugin on the WordPress platform and does not affect other WordPress components directly.

The flaw offers a direct web‑based attack path for any authenticated Salon Staff or Salon Worker account, with no additional prerequisites indicated. Because the flaw can eliminate administrator access, it poses a moderate risk level, as reflected by the CVSS score of 5.5. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. An upgrade to version 10.31.11 or later addresses the issue, so mitigation is available.