CVE-2022-0920: 
WordPress vulnerability analysis and mitigation

CVE-2022-0920 affects the Salon booking system Free and Pro WordPress plugins versions before 7.6.3. The vulnerability was discovered and publicly disclosed on March 21, 2022, with the last update made on April 11, 2022. The issue stems from improper authorization in some of the plugin's endpoints (WPScan).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) with a CVSS score of 7.5 (High). The security flaw exists in the plugin's API endpoints where proper authorization checks are missing, allowing authenticated customers to access data beyond their intended permissions. The vulnerability falls under the OWASP Top 10 category A5: Broken Access Control (WPScan).

The vulnerability allows customers with basic accounts to access all bookings and other customers' data through the plugin's API endpoints. This represents a significant privacy breach as it exposes sensitive customer information to unauthorized users (WPScan).

The vulnerability has been fixed in version 7.6.3 of both the Salon booking system Free and Pro plugins. Users are advised to update to this version or later to protect against unauthorized data access (WPScan).