PT-2025-37133 · Wordpresschef · Salon Booking System – Free Version+1

Codecheq Devs · Publicado 2025-09-11 · Atualizado 2025-09-11 · CVE-2025-8492

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploads.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-8492

Produtos afetados

Salon Booking System – Free Version

Salon Booking System

Referências · 4

• https://wordfence.com/threat-intel/vulnerabilities/id/9a63a4ec-80e6-48cc-a778-97fa3917817e?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.20/src/SLN/Plugin.php#L232 · Nota
• https://plugins.trac.wordpress.org/changeset/3360651/salon-booking-system/trunk/src/SLN/Action/Ajax/UploadFile.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-8492 · Nota de Segurança