CVE-2023-48319: 
WordPress vulnerability analysis and mitigation

The Salon booking system plugin for WordPress contains a privilege escalation vulnerability (CVE-2023-48319) affecting all versions up to, but excluding, 8.7. The vulnerability was discovered by researcher lttn and was publicly disclosed on November 23, 2023 (WPScan).

This security issue is classified as a Privilege Escalation vulnerability (CWE-269) with a CVSS score of 7.2 (high severity). The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan, Patchstack).

The vulnerability allows authenticated attackers with editor-level access and above to escalate their privileges to that of an administrator, potentially enabling full control of the affected WordPress website (WPScan, Patchstack).

The vulnerability requires an authenticated user with at least editor-level privileges to exploit. It was initially reported on September 10, 2023, by researcher lttn (Patchstack).

Website administrators are advised to update the Salon booking system plugin to version 8.7 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).