Salon Booking System – Appointment Booking for Salons, Barbershops & Spas < 10.31.9 - Unauthenticated Privilege Escalation

Description

The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.31.7. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.