CVE-2026-110032
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user accounts its salon staff roles may edit through the customers management screen. This allows users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account.
Risk Assessment
An attacker with a low-privileged role can revoke administrator privileges and lock out legitimate administrators, leading to loss of site control. This can result in full site takeover or lockout.
Recommendation
Update the Salon Booking System plugin to version 10.31.11 or later. Check for unauthorized changes to user roles and profiles.
Other vulnerabilities in Salon Booking System WordPress plugin
See all- CVE-2026-110034Low
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total. This allows an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
- CVE-2026-110031High
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer. This allows them to escalate any account to administrator and take over the site.
- CVE-2026-110015High
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
- CVE-2026-110014Medium
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
- CVE-2026-110013Medium
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the plugin and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
- CVE-2026-110012Medium
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Original NVD description (English source)
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS