CVE-2026-11887: Salon Booking System Plugin Authorization Bypass (v10.30.20)

Technical summary

CVE-2026-11887 stems from insufficient authorization checks on an AJAX action within the Salon Booking System plugin. The vulnerability permits any authenticated user, regardless of role, to invoke privileged functions that should be restricted to administrators. By crafting requests to modify plugin settings, attackers can disable or circumvent the manual booking approval mechanism, altering the system's operational behavior without proper permission validation.

Business impact

Salons relying on manual booking approval as a quality-control or verification step face operational disruption. Attackers with low-privilege accounts could alter booking workflows, potentially resulting in unauthorized appointment modifications, loss of revenue control, customer dissatisfaction, and reputational damage. For multi-user salon environments, this undermines trust in the booking pipeline and creates audit and compliance concerns around booking integrity.

Affected systems

WordPress installations using the Salon Booking System plugin at version 10.30.19 and earlier are affected. The vulnerability is present in all prior versions; only version 10.30.20 and later include the necessary authorization fixes. Plugins installed on WordPress multisite networks are equally vulnerable.

Exploitability

The vulnerability has a CVSS 3.1 score of 4.3 (MEDIUM severity) with a network-based attack vector requiring low privileges and no user interaction. Exploitation is straightforward: an attacker needs a valid WordPress account—easily obtained or granted by salon staff—to send a crafted AJAX request. No complex tooling or specialized knowledge is required, making this a low-friction attack for insiders or low-privilege users.

Remediation

Update the Salon Booking System plugin to version 10.30.20 or later immediately. The patch introduces proper role-based authorization checks on the vulnerable AJAX action, ensuring only administrators can modify booking approval settings. After patching, verify that subscriber and contributor accounts no longer have access to booking system configuration.

Patch guidance

Access the WordPress dashboard, navigate to Plugins > Installed Plugins, locate the Salon Booking System plugin, and apply the available update to version 10.30.20 or later. If automatic updates are not enabled, manually download the patched version from the official WordPress plugin repository and upload it. Test the booking workflow in a staging environment first to confirm that the approval process functions as intended post-update. Ensure all administrators reset their sessions after the patch is applied.

Detection guidance

Monitor WordPress access logs and audit trails for AJAX requests to the vulnerable action originating from low-privilege accounts. Review the plugin's settings audit log (if available) for unexplained changes to booking approval settings made by non-administrator users. Check for suspicious POST requests to wp-admin/admin-ajax.php with parameters related to plugin configuration. Conduct a review of recent booking records to identify any that may have been processed in violation of the manual approval policy during the window of vulnerability.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability directly threatens core business logic in a booking context. The low barrier to exploitation—requiring only a valid user account—combined with the ability to disable safety controls makes this a moderate-priority issue for salons. It is not critical, but should not be deferred. Organizations with multi-staff environments or external contractor access should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the authorization bypass nature of the flaw. Network accessibility (AV:N) and low privilege requirements (PR:L) increase the score; however, the impact is limited to integrity (I:L) with no confidentiality or availability loss, keeping the severity in the MEDIUM range. The practical risk is elevated by the ease of exploitation and the operational sensitivity of booking workflows.

Frequently asked questions