CVE-2026-110015: Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF

Q: Who is exposed to exploitation?

Sites using Salon Booking System versions before 10.31.9 are exposed when an administrator is logged in to WordPress and can be induced to click an attacker-controlled link.

Q: Does the attacker need administrator credentials or prior access to the site?

No. The issue allows unauthenticated attackers to forge REST API requests through the browser of a logged-in administrator; the attacker relies on that administrator's authenticated session.

Q: What is the likely impact of a successful attack?

An attacker can perform actions with the logged-in administrator's privileges through forged REST API requests, including creating a new administrator account.

Q: What should be done if immediate patching is not possible?

The provided information does not specify a workaround. Reduce exposure by ensuring administrators do not follow untrusted links while logged in, since exploitation requires a logged-in administrator to click a crafted link.

Published Oct 16, 2026

Updated

The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.

Affected Software

1 affected component

Salon Booking System Salon Booking System<10.31.9

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Sites using Salon Booking System versions before 10.31.9 are exposed when an administrator is logged in to WordPress and can be induced to click an attacker-controlled link.

Does the attacker need administrator credentials or prior access to the site?

No. The issue allows unauthenticated attackers to forge REST API requests through the browser of a logged-in administrator; the attacker relies on that administrator's authenticated session.

What is the likely impact of a successful attack?

An attacker can perform actions with the logged-in administrator's privileges through forged REST API requests, including creating a new administrator account.

What should be done if immediate patching is not possible?

The provided information does not specify a workaround. Reduce exposure by ensuring administrators do not follow untrusted links while logged in, since exploitation requires a logged-in administrator to click a crafted link.

CVE-2026-110015: Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF

Affected Software

Event History

Frequently Asked Questions

Who is exposed to exploitation?

Does the attacker need administrator credentials or prior access to the site?

What is the likely impact of a successful attack?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

Does the attacker need administrator credentials or prior access to the site?

What is the likely impact of a successful attack?

What should be done if immediate patching is not possible?