{"id":"CVE-2026-110032","kind":"vulnerability","aliases":["CVE-2026-110032"],"related":[],"title":"WordPress Salon Booking plugin lets staff reset any account, including admins","description":"The Salon Booking System  WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.","summary":"The Salon Booking System WordPress plugin before 10.31.11 lets users with the Salon Staff or Salon Worker role edit any other account through the customers screen. An attacker holding that role can demote administrators to customers and overwrite arbitrary profile fields, which can lock the site owner out.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","salon-booking-system","self-hosted","wordpress"],"not_affected_if":["no-salon-staff-roles-assigned","plugin-version-10.31.11-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected if below `10.31.11`\n- List users holding the Salon Staff or Salon Worker role and confirm they are trusted staff","fix":"- Update the Salon Booking System plugin to `10.31.11` or later\n- Review administrator accounts and roles for unexpected changes after the update","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:14:03+00:00","updated_at":"2026-10-25T04:14:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:14:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Salon Booking System plugin to `10.31.11` or later\n- Review administrator accounts and roles for unexpected changes after the update","reach":"internet","title":"WordPress Salon Booking plugin lets staff reset any account, including admins","impact":"high","summary":"The Salon Booking System WordPress plugin before 10.31.11 lets users with the Salon Staff or Salon Worker role edit any other account through the customers screen. An attacker holding that role can demote administrators to customers and overwrite arbitrary profile fields, which can lock the site owner out.","category":"package","nicknames":[],"who_cares":["wordpress","salon-booking-system","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker with staff role demotes admins and takes control of the site","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected if below `10.31.11`\n- List users holding the Salon Staff or Salon Worker role and confirm they are trusted staff","needs_analyst":false,"not_affected_if":["plugin-version-10.31.11-or-later","no-salon-staff-roles-assigned"],"who_is_affected":"Sites running the Salon Booking System WordPress plugin older than 10.31.11 that have users assigned the Salon Staff or Salon Worker role. Sites without this plugin, or where no one holds those roles, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3344,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110032':14A,17A '-2026':13A,16A '10.31.11':34B,81C 'access':135C 'account':9A,48B,87C,129C 'admin':11A 'administr':60B,117C,134C 'allow':99C 'arbitrari':65B,124C 'attack':54B 'book':3A,21B,29B,76C 'custom':51B,62B,96C,120C 'cve':12A,15A 'demot':59B 'edit':45B,93C 'field':67B,126C 'hold':55B 'host':25B 'includ':10A,116C 'lead':130C 'let':5A,35B 'lock':70B 'lockout':139C 'loss':132C 'manag':97C 'may':92C 'overwrit':64B,123C 'owner':73B 'packag':18B 'plugin':4A,32B,79C 'potenti':137C 'profil':66B,125C 'reset':7A,110C 'restrict':84C 'role':44B,57B,91C,108C,115C 'salon':2A,20B,28B,39B,42B,75C,89C,103C,106C 'salon-booking-system':19B 'screen':52B,98C 'self':24B 'self-host':23B 'site':72B,138C 'staff':6A,40B,90C,104C 'system':22B,30B,77C 'user':36B,86C,100C,113C 'wordpress':1A,26B,31B,78C 'worker':43B,107C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Salon Booking System WordPress plugin older than 10.31.11 that have users assigned the Salon Staff or Salon Worker role. Sites without this plugin, or where no one holds those roles, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110032","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}