CVE-2025-66531

Analysis

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Salon booking system plugin by Dimitri Grassi, affecting versions up to and including 10.30.3 [1]. This flaw allows an attacker to craft malicious requests that are executed by a privileged user without their knowledge.

Exploitation

Exploitation requires user interaction, where a privileged user (such as an administrator) must click a malicious link, visit a crafted page, or submit a form [1]. The attacker can initiate the CSRF attack from any website, leveraging the user's active session in the WordPress admin panel.

Impact

Successful exploitation enables an attacker to force the targeted user to perform unintended actions, such as modifying plugin settings or creating new bookings, under the user's current authentication [1]. This could lead to unauthorized changes within the Salon booking system.

Mitigation

The vulnerability has been patched in version 10.30.4. As an immediate action, update the plugin to the latest version [1]. Patchstack users can enable auto-updates for vulnerable plugins to mitigate this risk.