CVE-2026-110031
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its…
- Risk score
- 46/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 18 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
- Affected
- See advisory
- Fix
- Upgrade the product to 10.31.11 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
Last activity 18 Oct 2026. Patch Forecast updates every hour.