CVE-2025-67954: 
WordPress vulnerability analysis and mitigation

CVE-2025-67954 is a Sensitive Data Exposure vulnerability (CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere) in the Dimitri Grassi "Salon booking system" WordPress plugin. It affects all versions up to and including 10.30.3, and was reported by researcher "daroo" on November 7, 2025, with public disclosure on January 22, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), assessed by CISA-ADP (Patchstack).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and maps to CAPEC-170 (Web Application Fingerprinting). It allows authenticated attackers with at least Subscriber-level privileges to retrieve embedded sensitive data that should not be accessible to regular users, exploitable over the network with low attack complexity and no user interaction required. The attack vector is network-based, requiring only low privileges, suggesting the plugin exposes sensitive system information through an insufficiently protected endpoint or API response accessible to authenticated low-privilege users (Patchstack).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. An attacker with a basic subscriber account on a WordPress site running the vulnerable plugin can access sensitive system information that is normally restricted, which could be leveraged to facilitate further attacks against the site or its users. The exposed data could include configuration details, credentials, or other sensitive embedded information that aids in escalating privileges or compromising the broader WordPress environment (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vulnerability is patched in Salon booking system version 10.30.4. Site administrators should update the plugin to version 10.30.4 or later immediately. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated, and auto-update for vulnerable plugins can be enabled through the Patchstack platform (Patchstack).