CVE-2025-66531: 
WordPress vulnerability analysis and mitigation

CVE-2025-66531 is a Cross-Site Request Forgery (CSRF) vulnerability in the Dimitri Grassi "Salon booking system" WordPress plugin, affecting all versions through 10.30.3. The vulnerability was reported by researcher "daroo" on November 7, 2025, and publicly disclosed on December 7–9, 2025, with the CVE assigned by Patchstack. The patched version is 10.30.4. The NVD assigns a CVSS v3.1 base score of 8.8 (High), while Patchstack rates it 4.3 (Medium) using a WordPress-specific scoring methodology (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from the plugin's failure to validate the origin of state-changing HTTP requests, allowing an attacker to craft a malicious page or link that, when visited by an authenticated user, submits unauthorized requests on their behalf. No anti-CSRF token or nonce verification is enforced for sensitive plugin actions, meaning any authenticated session can be abused without the user's knowledge. Exploitation requires user interaction — specifically, a logged-in WordPress user must be tricked into clicking a malicious link or visiting a crafted page (Patchstack).

Successful exploitation allows an attacker to force authenticated users — including administrators — to perform unauthorized actions within the Salon booking system, such as modifying booking configurations, creating or deleting bookings, or altering system settings. This affects the confidentiality, integrity, and availability of the salon management data. The impact is bounded to the plugin's functional scope but could disrupt business operations for salon owners relying on the plugin (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000080, reflecting a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that CSRF vulnerabilities of this type are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Salon booking system plugin at version 10.30.3 or earlier, using tools like WPScan or Shodan with WordPress plugin fingerprinting.
2. Identify target action: Determine which plugin endpoints or form actions lack CSRF token validation (e.g., booking creation, deletion, or configuration update endpoints).
3. Craft malicious request: Create an HTML page or form that auto-submits a forged HTTP request to the vulnerable plugin endpoint, mimicking a legitimate action (e.g., deleting all bookings or changing admin settings).
4. Deliver to victim: Send the malicious link or embed the auto-submitting form in a page visited by an authenticated WordPress user (e.g., via phishing email, forum post, or comment).
5. Action executes: When the authenticated user visits the page, their browser automatically sends the forged request with their valid session cookies, causing the plugin to execute the unauthorized action with the victim's privileges (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Salon booking system plugin endpoints (e.g., /wp-admin/admin-ajax.php or plugin-specific URLs) from unusual referrers or external origins.
• Application: Unexplained changes to booking records, configurations, or plugin settings without corresponding administrator activity in the WordPress audit log.
• Network: Requests to plugin action endpoints originating from external or unexpected domains in the HTTP Referer header, indicating a cross-origin submission.

Update the Salon booking system WordPress plugin to version 10.30.4 or later, which contains the fix for this vulnerability. If an immediate update is not possible, restrict access to the WordPress admin area using IP allowlisting or additional authentication layers. Patchstack users can enable auto-update for vulnerable plugins as an interim measure (Patchstack).