Summary
CVE-2026-66453 is a critical unauthenticated authentication bypass vulnerability affecting the Salon Booking System WordPress plugin, developed by Dimitri Grassi. The flaw allows a remote, unauthenticated attacker to bypass the plugin’s authentication mechanism using an alternate path or channel. It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting network-exploitable, low-complexity access with high impact to confidentiality, integrity, and availability.
Technical details
- Root cause: The plugin implements an authentication-related code path (e.g., password/session recovery or login handling) that can be reached through an alternate channel without validating the requester’s identity, classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
- Trigger conditions: No authentication or user interaction is required to exploit the flaw; the vulnerable functionality is exposed to any remote requester.
- Attack vector: Network — the vulnerability is exploitable remotely over HTTP/HTTPS against the WordPress site running the affected plugin.
- Impact: Successful exploitation allows an unauthenticated attacker to bypass authentication controls, potentially gaining unauthorized access to accounts or protected plugin functionality, with high impact to confidentiality, integrity, and availability.
Affected software
- Salon Booking System (WordPress Plugin) — all versions up to and including 10.30.26
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the Salon Booking System plugin to version 10.30.27 or later, which resolves this vulnerability.
- If immediate patching is not possible: Restrict or disable public access to the plugin’s booking/authentication endpoints until the update can be applied, and monitor site logs for unusual authentication or booking-related requests.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
salon-booking-system/js/

