CVE-2026-11887

The Salon Booking System WordPress plugin, in versions before 10.30.20 , is vulnerable to an authorization bypass. The root cause is insufficient authorization checks on one of its AJAX actions . This allows any authenticated user , such as a subscriber, to modify plugin settings and bypass the m...