The Salon Booking System WordPress plugin before 10.31.11 implements a role management interface that is not properly gated; users with Salon Staff or Salon Worker roles can edit the roles of any other user through the customer editing screen. This flaw enables an attacker to downgrade an administrator to a customer role, overwrite arbitrary profile fields, and effectively remove administrative control from the site, potentially locking the site from legitimate administrators.

All installations of the Salon Booking System WordPress plugin with versions earlier than 10.31.11. The vulnerability is contained to this plugin on the WordPress platform and does not affect other WordPress components directly.

The flaw offers a direct web‑based attack path for any authenticated Salon Staff or Salon Worker account, with no additional prerequisites indicated. Because the attack can eliminate administrator access, the risk is high. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a supporting mitigation and the high potential impact warrant urgent remediation.