{"id":"CVE-2026-110014","kind":"vulnerability","aliases":["CVE-2026-110014"],"related":[],"title":"Salon Booking System WordPress plugin lets anyone forge bookings and payments","description":"The Salon Booking System  WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.","summary":"The Salon Booking System WordPress plugin before 10.31.9 does not check authorization when creating a booking. An unauthenticated attacker can create bookings under arbitrary users, overwrite their stored contact details, and mark bookings as paid or confirmed without payment.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-updated-to-10.31.9"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/` and compare it to `10.31.9`\n- unknown","fix":"- Update the Salon Booking System plugin to `10.31.9` or later\n- unknown","status":"open","published_at":"2026-10-16T07:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:38+00:00","updated_at":"2026-10-25T04:28:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:28:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Salon Booking System plugin to `10.31.9` or later\n- unknown","reach":"internet","title":"Salon Booking System WordPress plugin lets anyone forge bookings and payments","impact":"medium","summary":"The Salon Booking System WordPress plugin before 10.31.9 does not check authorization when creating a booking. An unauthenticated attacker can create bookings under arbitrary users, overwrite their stored contact details, and mark bookings as paid or confirmed without payment.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers forge paid bookings and overwrite customer contact details","analyst_note":"Confirm the affected endpoint and whether a default configuration is exposed; check the plugin changelog for 10.31.9 at the NVD entry.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/` and compare it to `10.31.9`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-updated-to-10.31.9"],"who_is_affected":"Sites running the Salon Booking System WordPress plugin before 10.31.9 that accept bookings are exposed, since the flaw is in the booking creation path. Sites that do not run the plugin, or run a fixed version, are not affected. The sources do not say whether a non-default setting is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000612,"input_tokens":3334,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110014':14A,17A '-2026':13A,16A '10.31.9':33B,72C 'allow':93C 'anyon':7A 'arbitrari':49B,101C 'attack':44B,95C 'attribut':99C 'author':37B,77C 'book':2A,9A,28B,41B,47B,58B,67C,81C,91C,98C,111C 'caller':86C 'caller-suppli':85C 'check':36B,76C 'confirm':62B,115C 'contact':54B,107C 'creat':39B,46B,79C,97C 'cve':12A,15A 'detail':55B,108C 'forg':8A 'host':21B 'identifi':89C 'let':6A 'mark':57B,110C 'overwrit':51B,103C 'packag':18B 'paid':60B,113C 'payment':11A,64B,118C 'plugin':5A,25B,31B,70C 'proper':75C 'salon':1A,27B,66C 'self':20B 'self-host':19B 'status':92C 'store':53B,106C 'suppli':87C 'system':3A,29B,68C 'trust':83C 'unauthent':43B,94C 'user':50B,88C,102C,105C 'without':63B,116C 'wordpress':4A,22B,24B,30B,69C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Salon Booking System WordPress plugin before 10.31.9 that accept bookings are exposed, since the flaw is in the booking creation path. Sites that do not run the plugin, or run a fixed version, are not affected. The sources do not say whether a non-default setting is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110014","severity":null,"published_at":"2026-10-16T07:17:10+00:00","modified_at":"2026-10-16T15:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}