CVE-2024-4468 - CVE House
Back to Database
Status published Medium CVE-2024-4468

Salon booking system <= 9.9 - Missing Authorization

Vulnerability Description

The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-4468

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Stephanie Walters

References

More from wordpresschef

View All →
CVE-2025-8492
Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution
Medium 5.3
CVE-2025-32295
WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability
Medium 4.3
CVE-2024-4442
Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion
Critical 9.1
CVE-2024-3229
Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload
Critical 9.8
CVE-2023-3427
Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer
Medium 5.4

Affected Vendor

wordpresschef

View all reports →

Affected Software

Salon Booking System – Free Version
Vulnerable Versions:
0

Timeline

Official Publish: June 8th, 2024
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-280

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.