Live › vulnerability › CVE-2026-110014
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.9 does not check authorization when creating a booking. An unauthenticated attacker can create bookings under arbitrary users, overwrite their stored contact details, and mark bookings as paid or confirmed without payment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System WordPress plugin before 10.31.9 that accept bookings are exposed, since the flaw is in the booking creation path. Sites that do not run the plugin, or run a fixed version, are not affected. The sources do not say whether a non-default setting is required.
No product ranges from the sources yet.
wp-content/plugins/ and compare it to 10.31.910.31.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-110014")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.