Live › vulnerability › CVE-2026-110032
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.11 lets users with the Salon Staff or Salon Worker role edit any other account through the customers screen. An attacker holding that role can demote administrators to customers and overwrite arbitrary profile fields, which can lock the site owner out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System WordPress plugin older than 10.31.11 that have users assigned the Salon Staff or Salon Worker role. Sites without this plugin, or where no one holds those roles, are not exposed by this flaw.
No product ranges from the sources yet.
10.31.1110.31.11 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
This page as .md · .json · in your agent: get_signal("CVE-2026-110032")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.