CVE-2025-32220: Salon Booking System Auth Bypass Flaw

CVE-2025-32220 Overview

CVE-2025-32220 is a missing authorization vulnerability in the Dimitri Grassi Salon Booking System plugin for WordPress. The flaw affects all versions up to and including 10.30.23. Authenticated attackers with low-level privileges can exploit incorrectly configured access control checks to perform actions reserved for higher-privileged users. The issue is tracked under CWE-862: Missing Authorization and was published to the National Vulnerability Database (NVD) on April 4, 2025.

Critical Impact

Authenticated attackers can bypass access controls in the Salon Booking System plugin, leading to compromise of confidentiality, integrity, and availability of the WordPress site.

Affected Products

• Salon Booking System WordPress plugin versions up to and including 10.30.23
• WordPress sites running the salon-booking-system plugin by Dimitri Grassi
• All deployments where the plugin processes booking and customer data

Discovery Timeline

• 2025-04-04 - CVE-2025-32220 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-32220

Vulnerability Analysis

The Salon Booking System plugin exposes functionality that lacks proper authorization checks. The plugin fails to validate whether the requesting user holds the required capability or role before executing sensitive actions. Authenticated users with low privileges, such as subscribers or customers, can invoke endpoints intended for administrators or shop managers.

The vulnerability is categorized under CWE-862, which covers situations where the application does not perform an authorization check when an actor attempts to access a resource or perform an action. Successful exploitation can affect booking records, customer data, payment configuration, and plugin settings.

Root Cause

The root cause is the absence or misconfiguration of capability checks in plugin handlers. WordPress plugins typically enforce authorization with current_user_can() calls and nonce verification via check_admin_referer() or wp_verify_nonce(). In the affected versions, one or more action handlers omit these checks, allowing any authenticated request to reach privileged code paths.

Attack Vector

The attack vector is network-based and requires only low-level authentication. An attacker registers a standard account on the target WordPress site, or compromises an existing low-privileged account. The attacker then sends crafted HTTP requests to vulnerable plugin endpoints — typically through admin-ajax.php, admin-post.php, or REST API routes registered by the plugin. Because the endpoints do not validate the caller's role, the requests execute with the effect of a privileged user.

No public proof-of-concept or exploit code is currently listed in Exploit-DB or CISA KEV. Technical details are documented in the PatchStack Vulnerability Report.

Detection Methods for CVE-2025-32220

Indicators of Compromise

• Unexpected POST requests to admin-ajax.php containing Salon Booking System action parameters from low-privileged user sessions
• Modifications to booking records, services, or plugin settings without corresponding administrator login events
• New or altered user accounts created outside the standard WordPress registration workflow
• Anomalous REST API calls to /wp-json/ routes registered by the salon-booking-system plugin

Detection Strategies

• Audit WordPress access logs for requests to plugin endpoints originating from non-administrator session cookies
• Correlate plugin database table changes with the authenticated user ID that triggered them
• Deploy a web application firewall rule set that flags privileged plugin actions invoked by subscriber-level roles

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture user role, action, and IP address for every plugin request
• Forward web server and PHP error logs to a centralized SIEM for correlation across sessions
• Alert on first-time use of plugin AJAX actions by accounts that have never previously triggered them

How to Mitigate CVE-2025-32220

Immediate Actions Required

• Update the Salon Booking System plugin to a version higher than 10.30.23 once the vendor releases a fix
• Audit all WordPress user accounts and remove unused or unrecognized low-privileged accounts
• Restrict new user registration on the WordPress site if booking functionality does not require self-service signup
• Review booking, customer, and payment configuration records for unauthorized modifications

Patch Information

Review the PatchStack Vulnerability Report for the latest patched version information. Apply the vendor-supplied update through the WordPress plugin dashboard or via WP-CLI as soon as it becomes available.

Workarounds

• Disable the Salon Booking System plugin until a patched version is installed if booking functionality is not business-critical
• Place the WordPress administrative endpoints behind an IP allowlist or authentication proxy
• Deploy a web application firewall rule that blocks plugin AJAX and REST routes when the session role is below shop_manager

# Disable the plugin via WP-CLI until a patch is available
wp plugin deactivate salon-booking-system

# Verify current plugin version
wp plugin get salon-booking-system --field=version