CVE-2026-110015
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Risk Assessment
An attacker can perform actions on behalf of an administrator, including creating a new administrator account, leading to full site compromise.
Recommendation
Update the Salon Booking System plugin to version 10.31.9 or later.
Other vulnerabilities in Salon Booking System WordPress plugin
See all- CVE-2026-110014Medium
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
- CVE-2026-110013Medium
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the plugin and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
- CVE-2026-110012Medium
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Original NVD description (English source)
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS