CVE-2026-110014: Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it; no account or prior authorization is required to create a booking.
What control does an attacker have over a forged booking?
The attacker can supply an arbitrary customer user identifier and booking status. This can attribute bookings to other users, overwrite their stored contact details, and set bookings to paid or confirmed without payment.
Which installations are affected?
Salon Booking System WordPress plugin versions earlier than 10.31.9 are affected.