---
id: "CVE-2026-110014"
kind: "vulnerability"
aliases: ["CVE-2026-110014"]
title: "Salon Booking System WordPress plugin lets anyone forge bookings and payments"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-updated-to-10.31.9"]
published_at: "2026-10-16T07:17:10+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110014", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Salon Booking System WordPress plugin lets anyone forge bookings and payments

The Salon Booking System WordPress plugin before 10.31.9 does not check authorization when creating a booking. An unauthenticated attacker can create bookings under arbitrary users, overwrite their stored contact details, and mark bookings as paid or confirmed without payment.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or in `wp-content/plugins/` and compare it to `10.31.9`
- unknown

## Fix

- Update the Salon Booking System plugin to `10.31.9` or later
- unknown

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110014

## From the sources

The Salon Booking System  WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_