Unauthenticated Setting Modification in Salon Booking System WordPress Plugin

Executive Summary

The Salon Booking System plugin for WordPress, prior to version 10.30.20, contains a vulnerability that allows any authenticated user, including subscribers, to bypass the manual approval process for new bookings.

This happens because the plugin does not have proper authorization checks on one of its AJAX actions, which lets users modify a plugin setting to automatically confirm all new bookings.

The vulnerability is classified under OWASP A5 (Broken Access Control) and CWE-862 (Missing Authorization).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing any authenticated user, even those with low-level permissions like subscribers, to bypass the manual approval process for new bookings.

As a result, unauthorized or unverified bookings could be automatically confirmed without proper oversight, potentially leading to misuse or abuse of the booking system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Salon Booking System WordPress plugin to version 10.30.20 or later, where the issue has been fixed.

Until the update is applied, restrict authenticated user roles that can access the vulnerable AJAX action to prevent unauthorized modification of plugin settings and bypassing manual approval of new bookings.

Useful 0 Not Useful 0