CVE-2026-11887
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile — higher than 8% of all known CVEs
Summary
The Salon Booking System WordPress plugin before version 10.30.20 lacks proper authorization checks on one of its AJAX actions, allowing any authenticated user (e.g., a subscriber) to modify a plugin setting and bypass manual approval of new bookings.
Risk Assessment
The risk is that an unauthorized user can change plugin settings, potentially accepting fake or unwanted bookings without administrator consent, disrupting salon operations.
Recommendation
It is recommended to immediately update the Salon Booking System plugin to version 10.30.20 or later, which includes the necessary authorization fixes.
Original NVD description (English source)
The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.