Skip to content
fr Sign in
5.5 Medium

CVE-2026-110032 The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles…

Description

The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.

Affected products and versions

Product Affected versions Fixed in
Salon booking system 10.31 earliest → < 10.31.11 10.31.11

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Salon booking system

The 21 CVEs of Salon booking system →
CVE-2026-110034 The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a… 3.7 Low CVE-2026-110031 The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role… 7.2 High CVE-2026-110033 The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching… 6.8 Medium CVE-2026-110035 The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon… 4.3 Medium
Track this CVE