{"id":"CVE-2026-110031","kind":"vulnerability","aliases":["CVE-2026-110031"],"related":[],"title":"Salon Booking System WordPress plugin: staff role can grant administrator rights","description":"The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.","summary":"The Salon Booking System WordPress plugin before 10.31.11 lets users with its custom salon staff role assign arbitrary capabilities to other accounts while editing a customer. An attacker holding that role can escalate any account, including their own, to administrator and take over the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","salon-booking-system","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-salon-staff-users","plugin-at-or-above-10.31.11"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get salon-booking-system --field=version` (unknown if the slug differs)\n- Check whether any users hold the salon staff role in Users, or with `wp user list --role=<salon staff role slug>`","fix":"- Update the Salon Booking System plugin to `10.31.11` or later\n- Review administrator accounts and remove any added without cause; rotate passwords for accounts that held the staff role","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:29:24+00:00","updated_at":"2026-10-25T03:29:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Salon Booking System plugin to `10.31.11` or later\n- Review administrator accounts and remove any added without cause; rotate passwords for accounts that held the staff role","reach":"internet","title":"Salon Booking System WordPress plugin: staff role can grant administrator rights","impact":"high","summary":"The Salon Booking System WordPress plugin before 10.31.11 lets users with its custom salon staff role assign arbitrary capabilities to other accounts while editing a customer. An attacker holding that role can escalate any account, including their own, to administrator and take over the site.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","salon-booking-system","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker becomes WordPress administrator and takes over the whole site","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get salon-booking-system --field=version` (unknown if the slug differs)\n- Check whether any users hold the salon staff role in Users, or with `wp user list --role=<salon staff role slug>`","needs_analyst":false,"not_affected_if":["plugin-at-or-above-10.31.11","no-salon-staff-users"],"who_is_affected":"Sites running the Salon Booking System plugin before `10.31.11` that have users assigned its custom salon staff role. Sites without the plugin, or where no one holds that role, are not exposed through this flaw. The sources do not say whether non-staff roles can reach the same path.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3304,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110031':14A,17A '-2026':13A,16A '10.31.11':37B,82C 'account':51B,64B,99C,109C 'administr':10A,69B,111C 'allow':104C 'arbitrari':47B,95C 'assign':46B,94C 'attack':57B 'book':2A,21B,32B,77C 'capabl':48B,96C 'custom':42B,55B,89C,103C 'cve':12A,15A 'edit':53B,101C 'escal':62B,107C 'grant':9A 'hold':58B,87C 'host':25B 'includ':65B 'let':38B 'packag':18B 'plugin':5A,29B,35B,80C 'prevent':85C 'right':11A 'role':7A,45B,60B,92C 'salon':1A,20B,31B,43B,76C,90C 'salon-booking-system':19B 'self':24B 'self-host':23B 'site':74B,116C 'staff':6A,44B,91C 'system':3A,22B,33B,78C 'take':71B,113C 'user':39B,86C 'wordpress':4A,26B,28B,34B,79C 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Salon Booking System plugin before `10.31.11` that have users assigned its custom salon staff role. Sites without the plugin, or where no one holds that role, are not exposed through this flaw. The sources do not say whether non-staff roles can reach the same path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110031","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}