This vulnerability stems from incorrect privilege assignment within the Salon Booking System Pro plugin for WordPress, allowing an attacker who is authenticated but not privileged to elevate their access rights. The result is a full account takeover, giving the attacker control over site settings and user data. The weakness corresponds to improper privilege management.

The attack impacts installations of Salon Booking System Pro through version 10.30.11, including all WordPress sites that have the plugin enabled. Users should verify the plugin version and consult the vendor for updates.

The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests that current exploitation is unlikely, and it is not listed in the CISA KEV catalog. Nonetheless, the likely attack vector is a remote attacker who can log in with a non‑admin account and then exploit the privilege‑escalation flaw, potentially compromising the entire site.