Description
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Salon Booking System | < 10.30.34 | 10.30.34 |
References
- https://wpscan.com/vulnerability/fbbfa907-3efd-4050-9651-d3836af062a9/ exploit vdb-entry technical-description