---
id: "CVE-2026-110032"
kind: "vulnerability"
aliases: ["CVE-2026-110032"]
title: "WordPress Salon Booking plugin lets staff reset any account, including admins"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "salon-booking-system", "self-hosted", "wordpress"]
not_affected_if: ["no-salon-staff-roles-assigned", "plugin-version-10.31.11-or-later"]
published_at: "2026-10-18T07:16:52+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:14:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110032", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# WordPress Salon Booking plugin lets staff reset any account, including admins

The Salon Booking System WordPress plugin before 10.31.11 lets users with the Salon Staff or Salon Worker role edit any other account through the customers screen. An attacker holding that role can demote administrators to customers and overwrite arbitrary profile fields, which can lock the site owner out.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; affected if below `10.31.11`
- List users holding the Salon Staff or Salon Worker role and confirm they are trusted staff

## Fix

- Update the Salon Booking System plugin to `10.31.11` or later
- Review administrator accounts and roles for unexpected changes after the update

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110032

## From the sources

The Salon Booking System  WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_