The vulnerability is a Missing Authorization flaw that allows attackers to bypass the Salon booking system’s authorization checks. Because the plugin does not verify the requester’s privileges, an attacker can create, modify, or delete booking entries and read sensitive customer data, potentially compromising confidentiality and integrity of booking information. The issue results from a failure to enforce proper access control (CWE-862).

WordPress sites that have installed the Salon booking system plugin from Dimitri Grassi and are running a version of the plugin 10.31.9 or earlier. Any site with the vulnerable plugin should verify its installed version and assess exposure.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of <1% suggests a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, indicating no documented exploitation. Attackers could target the plugin’s endpoints via standard HTTP requests, bypassing permission checks; no special access is required beyond internet connectivity to the WordPress site.