CVE-2026-66453

The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.

An attacker can take over user or administrator accounts, potentially leading to data theft, unauthorized transactions, or full site compromise. This may also undermine customer trust.

Update the Salon booking system plugin to the latest version that includes the fix. If not available, implement additional authentication mechanisms such as multi-factor authentication and monitor login logs.