The Salon booking system plugin has an unauthenticated broken access control flaw, classified under CWE‑862, indicating that authorization checks have been bypassed. The result is that users without authentication may reach functionality reserved for authenticated users, potentially exposing or altering sensitive booking data and thus compromising confidentiality and integrity.

The vulnerability affects the WordPress Salon booking system plugin, developed by Dimitri Grassi, in all releases up to and including version 10.30.25. The plugin is distributed as a WordPress extension.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. Based on the description, it is inferred that the flaw could be exploited remotely via the plugin’s web interface, enabling attackers without credentials to gain unauthorized access to booking data. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks yet, but the potential for data compromise remains significant.