🔐 CVE Alert

CVE-2024-4468

MEDIUM 4.3

Salon booking system <= 9.9 - Missing Authorization

CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th

The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.

CWE CWE-280
Vendor wordpresschef
Product salon booking system – free version
Published Jun 8, 2024
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for wordpresschef salon booking system – free version

Be the first to know when new medium vulnerabilities affecting wordpresschef salon booking system – free version are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

wordpresschef / Salon Booking System – Free Version
0 ≤ 9.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/8b73f864-68b5-4ba8-93a3-37f2564cc240?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Tools.php#L12 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Tools.php#L16 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLN/Admin/Tools.php#L231 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L7 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L10 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php#L16 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3098413/salon-booking-system/trunk/src/SLN/Admin/Tools.php plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3098413/salon-booking-system/trunk/src/SLB_Discount/Admin/ExportDiscountsCsv.php

Credits

Stephanie Walters