Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2025-8492: Salon Booking System plugin lets attackers change data
CVE-2025-8492 · published 1 year ago
Summary
The Salon Booking System plugin for WordPress (versions up to 10.22) does not verify who is making certain AJAX requests. This lets anyone on the internet trigger actions, including uploading files or modifying information, without logging in. Update the plugin to the latest version or apply the vendor's recommended fix to restore proper access controls.
Original advisory text
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploads.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published11 Sep 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-8492 · NVD
Track software like this
Free during beta