CVE-2026-42666

Vulnerability

The Salon booking system plugin for WordPress versions up to and including 10.30.25 contains an unauthenticated broken access control vulnerability. This means that certain functions lack proper authorization or nonce checks, allowing unauthenticated users to execute actions that should require higher privileges [1].

Exploitation

An attacker can exploit this vulnerability without any authentication or user interaction. By sending crafted requests to the vulnerable endpoints, an unauthenticated attacker can trigger privileged actions. The vulnerability is considered highly dangerous and is expected to be used in mass-exploit campaigns targeting thousands of websites [1].

Impact

Successful exploitation allows an attacker to perform actions reserved for higher-privileged users, potentially leading to unauthorized data access, modification, or other malicious activities. The exact impact depends on the specific broken access control functions, but it can result in complete compromise of the affected site [1].

Mitigation

The vulnerability is fixed in version 10.30.26 of the plugin. Users are strongly advised to update immediately. If unable to update, users should contact their hosting provider or web developer for assistance. Patchstack has issued a mitigation rule to block attacks until the update is applied [1].