Salon Staff Role Privilege Escalation in WordPress Plugin

Executive Summary

The Salon Booking System WordPress plugin before version 10.31.11 has a vulnerability where users with the Salon Staff or Salon Worker role can reset any user's role to a customer and overwrite profile fields. This is due to improper authorization checks in the customer management screen.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Salon Booking System plugin in WordPress. If it is below 10.31.11, the system is vulnerable. Logs may show unauthorized role changes or profile modifications by users with Salon Staff or Salon Worker roles.

Useful 0 Not Useful 0

Impact Analysis

An attacker with the Salon Staff or Salon Worker role could remove administrative access from any user, including administrators, and overwrite profile fields. This could lead to loss of control over the WordPress site and potential lockout of legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of user data, potentially violating GDPR's data integrity and access control requirements or HIPAA's access control and integrity rules. Unauthorized role changes may also compromise audit logs and user consent mechanisms.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.11 or later immediately. Review user roles and permissions to ensure no unauthorized changes have occurred. Remove or restrict Salon Staff and Salon Worker roles if they are not needed.

Useful 0 Not Useful 0