Live › vulnerability › CVE-2026-110031
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.11 lets users with its custom salon staff role assign arbitrary capabilities to other accounts while editing a customer. An attacker holding that role can escalate any account, including their own, to administrator and take over the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System plugin before 10.31.11 that have users assigned its custom salon staff role. Sites without the plugin, or where no one holds that role, are not exposed through this flaw. The sources do not say whether non-staff roles can reach the same path.
No product ranges from the sources yet.
wp plugin get salon-booking-system --field=version (unknown if the slug differs)wp user list --role=<salon staff role slug>10.31.11 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-110031")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.