5.4
Medium
CVE-2023-3427 The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and…
Description
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change the admin role to customer or change the user meta to arbitrary values via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Salon Booking System 8.4 | earliest → 8.4.7 | No fix stated |
| Salon Booking System – Free Version 8.4 | earliest → 8.4.7 | No fix stated |
Other CVEs of Salon Booking System
The 5 CVEs of Salon Booking System →
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Medium
CVE-2024-3229
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type…
9.8
Critical
CVE-2024-4468
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a…
4.3
Medium
CVE-2024-4442
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and…
9.1
Critical