CVE-2023-48319 MEDIUM

CVE-2023-48319: WordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerability

Vendor Salon Booking System
Product Salon booking system
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6.

Explanation of Vulnerability in Simple Terms

02Summary

The Salon Booking System versions 8.6 and earlier contain a privilege management flaw that allows high-privileged users to perform unauthorized actions when a victim interacts with a malicious link or page. An attacker with administrative or elevated access can read, modify, or delete sensitive data, or disrupt service availability. The vulnerability requires both high privileges and user interaction to exploit.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data; disrupt service availability.

Potential impact on your site

04Site Impact

A compromised admin account or trusted user could be tricked into actions that expose or corrupt booking data, customer information, or system availability.

Conditions required to exploit

05Prerequisites

Attacker must have high-level privileges (admin or equivalent); victim must click a malicious link or visit a crafted page.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5118 Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role' CVE-2026-1492 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration CVE-2025-12981 Listee <= 1.1.6 - Unauthenticated Privilege Escalation CVE-2026-1994 s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-9842 Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities