CVE-2026-110015: Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites using Salon Booking System versions before 10.31.9 are exposed when an administrator is logged in to WordPress and can be induced to click an attacker-controlled link.
Does the attacker need administrator credentials or prior access to the site?
No. The issue allows unauthenticated attackers to forge REST API requests through the browser of a logged-in administrator; the attacker relies on that administrator's authenticated session.
What is the likely impact of a successful attack?
An attacker can perform actions with the logged-in administrator's privileges through forged REST API requests, including creating a new administrator account.
What should be done if immediate patching is not possible?
The provided information does not specify a workaround. Reduce exposure by ensuring administrators do not follow untrusted links while logged in, since exploitation requires a logged-in administrator to click a crafted link.