CVE-2023-48319 is a medium severity (CVSS 6.8) privilege escalation flaw in the Salon Booking System plugin for WordPress, affecting versions through 8.6. The Patchstack page title points to 8.7 as the fix, but I could not load it, so confirm in the plugin changelog.
What's affected
The NVD record describes an Improper Privilege Management issue in Salon Booking System that allows privilege escalation, affecting versions from n/a through 8.6. The weakness is CWE-269 (Improper Privilege Management). The record scores it 6.8 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. The PR:H and UI:R parts mean a privileged account and a user action are involved.
The one reference is a Patchstack page. Its address names "plugin 8.7 editor privilege escalation", which suggests the issue involves the Editor role and that 8.7 is the next release. The page itself returned a block error to our fetch, so I cannot confirm the fixed version, the precise role involved or the timeline from the page. Treat the URL wording as a hint and the changelog as the proof.
The record does not flag the CVE as exploited in the wild.
How to check if you're exposed
With WP-CLI, read the installed version.
wp plugin list --name=salon-booking-system --fields=name,version,status,update
Anything at 8.6 or below is in the affected range. In the admin, open Plugins and read the version under Salon Booking System.
Then review accounts. The URL wording points at the Editor role, so list users with editor or higher roles using wp user list --role=editor, and confirm each belongs to a real person who needs it.
What to do now
- Update Salon Booking System to a release newer than 8.6, and read the changelog to confirm the fix.
- Review accounts with Editor, Shop Manager or Administrator roles and remove the ones you do not need.
- Enable two factor sign in for privileged accounts.
- Keep a per site record of plugin versions so you can answer advisories in minutes.
Why it matters
Privilege escalation bugs let an account with limited rights gain more. Booking plugins add their own roles and capabilities on top of WordPress, and every extra role is another place where a permission check can be missed.
The score is medium because the record needs a privileged starting account and a user action, but a staff account on a small business site is not hard to obtain through reused passwords. The same plan works for every plugin: keep an inventory, apply updates and prune accounts. See the Safeguard Gold page for this CVE for the record, and the free scan at gold.safeguard.sh/scan for your application dependencies.
Quick check
Which version fixes CVE-2023-48319?
I could not confirm it. The record says through 8.6, and the Patchstack page name suggests 8.7. Check the plugin changelog.
Does an attacker need an account?
Yes. The record vector requires high privileges and a user action.
Sources
Last reviewed: 19 October 2026.
