Input validation vulnerability in Salon booking system 8.4.7

The Salon Booking System plugin for WordPress could be vulnerable to an attack called Cross-Site Request Forgery in versions 8.4.6 and earlier. This means that if a malicious user can trick an administrator into clicking on a link, they could potentially change the admin role to customer or change the user meta to any value they choose without proper authentication. To protect against this, the plugin should have had a nonce validation check on the ‘save_customer’ function.