WordPress Plugin Vulnerabilities
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Arbitrary Booking Total Tampering
Description
The plugin does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-08-06 (about 3 days ago)
Added
2026-07-30 (about 10 days ago)
Last Updated
2026-07-30 (about 10 days ago)
WPScan 