CVE-2026-25334
Published: 25 March 2026
Summary
CVE-2026-25334 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25334 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the WordPress plugin Salon Booking System Pro (salon-booking-plugin-pro) developed by wordpresschef. This flaw enables privilege escalation and affects all versions of the plugin prior to 10.30.12. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows privilege escalation, potentially enabling full account takeover as detailed in the associated advisory.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/salon-booking-plugin-pro/vulnerability/wordpress-salon-booking-system-pro-plugin-10-30-12-account-takeover-vulnerability?_s_id=cve confirms the issue and recommends updating to version 10.30.12 or later to mitigate the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15647
Vulnerability details
Incorrect Privilege Assignment vulnerability in wordpresschef Salon Booking System Pro salon-booking-plugin-pro allows Privilege Escalation.This issue affects Salon Booking System Pro: from n/a through < 10.30.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping from unauthenticated remote exploitation of public-facing WordPress plugin (T1190) causing incorrect privilege assignment that enables privilege escalation (T1068) and full account takeover for use of valid accounts (T1078).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of software flaws like this CVE by patching the Salon Booking System Pro plugin to version 10.30.12 or later.
Enforces least privilege to restrict user capabilities, directly countering incorrect privilege assignment and escalation in the vulnerable plugin.
Mandates enforcement of approved access authorizations, helping to block privilege escalations exploited via the plugin's flawed privilege checks.