CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.
Explanation of Vulnerability in Simple Terms
Salon Booking Pro for WordPress contains a missing authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic user account can bypass permission checks to alter booking or salon information. This affects all versions up to 10.10.2. Site owners should update immediately to a patched version.
What an attacker can do
Modify booking or salon data without proper authorization using a low-privilege user account.
Potential impact on your site
Unauthorized users can alter salon bookings, settings, or customer data, potentially disrupting operations or exposing sensitive information.
Conditions required to exploit
Attacker must have a valid WordPress user account with low privileges (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
