Live › vulnerability › CVE-2026-110015
Go to dashboardSalon Booking System, a WordPress plugin, skips WordPress's nonce check on REST API requests made with logged-in sessions. An attacker who tricks a logged-in administrator into clicking a crafted link can make that administrator's browser create a new administrator account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version (Salon Booking System) in the WordPress admin plugin list; versions before 10.31.9 are affected.
Update the Salon Booking System plugin to 10.31.9 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
This page as .md · .json · in your agent: get_signal("CVE-2026-110015")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.