The Salon Booking System WordPress plugin versions prior to 10.30.20 have a missing authorization vulnerability (CWE-862) in an AJAX action. This flaw permits any authenticated user, regardless of their privilege level, to alter plugin settings and circumvent the manual approval process for new bookings. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low attack complexity and limited impact on integrity without affecting confidentiality or availability.

An attacker with any authenticated user account can modify booking system settings and bypass manual approval of new bookings. This could lead to unauthorized bookings being automatically approved, potentially disrupting business operations or enabling fraudulent reservations. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious booking activity. Avoid granting unnecessary authenticated access to low-privilege users.