CVE-2026-110015
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the…
- Risk score
- 58/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted …
- Affected
- See advisory
- Fix
- Upgrade the product to 10.31.9 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Last activity 16 Oct 2026. Patch Forecast updates every hour.