WordPress Plugin Vulnerabilities

Salon booking system <= 10.31.11 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
salon-booking-system
No known fix

References

CVE
CVE-2025-32220
URL
https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-10-7-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
NAWardRox
Verified
No
WPVDB ID
8335b094-02b0-42eb-a6ca-5105ac24d22c

Timeline

Publicly Published
2025-04-04 (about 1 year ago)
Added
2025-04-08 (about 1 year ago)
Last Updated
2026-10-15 (about 1 day ago)

Other

Published
Title
Published
2023-11-09
Title
Animator < 3.0.11 - Missing Authorization to Plugin Settings Update
Published
2024-04-25
Title
Photo Gallery by 10Web < 1.8.21 - Missing Authorization
Published
2025-08-22
Title
Acclectic Media Organizer <= 1.4 - Missing Authorization
Published
2026-02-23
Title
Directory Pro <= 2.5.6 - Missing Authorization
Published
2025-11-17
Title
ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update