CVE-2026-42666: WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability

Synopsis

This is a broken access control vulnerability in the Salon booking system WordPress plugin versions 10.30.25 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any remote visitor can trigger it without holding an account. Successful exploitation allows an attacker to read confidential data from the affected installation. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or session token is needed; the access control bypass is reachable by any unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user of the target site to exploit this vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and repeatable with no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An attacker can read data that should be restricted by access controls, such as customer booking records, personal details, or other sensitive information stored by the plugin.
• Confidentiality impact is rated HIGH, meaning the full scope of protected data accessible through the vulnerable endpoint may be exposed in a single unauthenticated request.
• No integrity or availability impact is indicated, so the attacker cannot modify records or disrupt the service through this specific vector.