{"id":"CVE-2026-110015","kind":"vulnerability","aliases":["CVE-2026-110015"],"related":[],"title":"Salon Booking System WordPress plugin: forged admin requests create new administrator","description":"The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.","summary":"Salon Booking System, a WordPress plugin, skips WordPress's nonce check on REST API requests made with logged-in sessions. An attacker who tricks a logged-in administrator into clicking a crafted link can make that administrator's browser create a new administrator account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","salon-booking-system","wordpress"],"not_affected_if":["plugin-not-installed","version-10.31.9-or-later"],"how_to_check":"Check the installed plugin version (Salon Booking System) in the WordPress admin plugin list; versions before 10.31.9 are affected.","fix":"Update the Salon Booking System plugin to 10.31.9 or later.","status":"open","published_at":"2026-10-16T07:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:34:52+00:00","updated_at":"2026-10-23T22:34:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:34:52Z","model":"claude-haiku-5-5","output":{"fix":"Update the Salon Booking System plugin to 10.31.9 or later.","reach":"internet","title":"Salon Booking System WordPress plugin: forged admin requests create new administrator","impact":"high","summary":"Salon Booking System, a WordPress plugin, skips WordPress's nonce check on REST API requests made with logged-in sessions. An attacker who tricks a logged-in administrator into clicking a crafted link can make that administrator's browser create a new administrator account.","category":"package","who_cares":["wordpress","salon-booking-system"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker gains a new administrator account on the WordPress site.","analyst_note":"","how_to_check":"Check the installed plugin version (Salon Booking System) in the WordPress admin plugin list; versions before 10.31.9 are affected.","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-10.31.9-or-later"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000482,"input_tokens":2945,"output_tokens":375,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110015':14A,17A '-2026':13A,16A '10.31.9':77C 'account':69B,134C 'across':100C 'admin':7A 'administr':11A,53B,62B,68B,114C,125C,133C 'allow':105C 'api':37B,86C,104C 'attack':46B,107C 'authent':83C,98C 'book':2A,21B,25B,72C 'browser':64B,127C 'check':34B,94C 'click':55B,116C 'cooki':97C 'cookie-authent':96C 'core':91C 'correct':80C 'craft':57B,118C 'creat':9A,65B,130C 'cve':12A,15A 'discard':89C 'forg':6A,121C 'link':58B,119C 'log':42B,51B,112C 'logged-in':41B,50B,111C 'made':39B 'make':60B 'new':10A,67B,132C 'nonc':33B,93C 'packag':18B 'plugin':5A,29B,75C 'request':8A,38B,87C,122C 'rest':36B,85C,103C 'salon':1A,20B,24B,71C 'salon-booking-system':19B 'session':44B,99C 'skip':30B 'system':3A,22B,26B,73C 'trick':48B,109C 'unauthent':106C 'verifi':81C 'whole':102C 'wordpress':4A,23B,28B,31B,74C,90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110015","severity":null,"published_at":"2026-10-16T07:17:10+00:00","modified_at":"2026-10-16T15:17:09+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}