The vulnerability identified as CVE-2026-25334 affects the Salon Booking System Pro plugin by wordpresschef. It involves incorrect privilege assignment that can lead to privilege escalation. The affected versions are all versions prior to 10.30.12. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to escalate privileges, potentially gaining unauthorized access to sensitive functions or data within the Salon Booking System Pro plugin. This could compromise the confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor the vendor's communications for updates and apply any released patches promptly. Until a fix is available, restricting access to the plugin and limiting exposure may reduce risk.