Plugin de système de réservation Salon WordPress <= 10.30.3 - Vulnérabilité Cross Site Request Forgery (CSRF)

The CSRF vulnerability in Salon booking system allows an attacker to trick a logged-in user into performing actions they did not intend to. For example, an attacker could craft a malicious link or embed a hidden form on a website that, when visited by a legitimate user, would trigger actions like modifying appointments, changing user details, or even creating new accounts without the user's knowledge. The potential impact ranges from minor account modifications to significant data breaches and unauthorized administrative actions, depending on the privileges of the affected user.

Websites utilizing the Salon booking system plugin, particularly those with shared hosting environments or those that haven't implemented robust security practices, are at increased risk. Users who frequently access the Salon booking system through untrusted links or websites are also vulnerable.

• wordpress / composer / npm:

grep -r 'salon-booking-system' /var/www/html/wp-content/plugins/
wp plugin list | grep salon-booking-system

• generic web:

curl -I https://example.com/salon-booking-system/appointment/create | grep -i 'csrf-token'

1. 2025-12-09Disclosure

   disclosure

1. Réservé2025-12-04
2. Publiée2025-12-09
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-66531 is to upgrade the Salon booking system to version 10.30.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive forms and requests. Implement strict Content Security Policy (CSP) headers to restrict the sources from which the browser can load resources. Regularly review and validate user input to prevent unexpected behavior.

Installations actives

3KConnu

Note du plugin