CVE-2024-4468 describes a permissions-related vulnerability in the Salon Booking System – Free Version WordPress plugin by wordpresschef. The plugin fails to properly check user capabilities on several functions triggered during the admin_init action. As a result, authenticated users with subscriber or higher roles can access and modify plugin settings and view discount codes not intended for them. This improper handling of insufficient privileges is categorized under CWE-280. The vulnerability affects all versions up to and including 9.9. There is no indication of known exploits in the wild or an official patch available at this time.

The vulnerability allows unauthorized modification of plugin settings and unauthorized viewing of discount codes by users with subscriber-level access or higher. This could lead to unauthorized configuration changes and exposure of sensitive promotional information. There is no direct impact on confidentiality of other data, no denial of service, and no elevation to administrative privileges indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting subscriber-level access or disabling the plugin if possible to prevent exploitation. Monitor for updates from wordpresschef regarding a security patch.