5.5
Moyenne
CVE-2026-110032 The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles…
Description
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Salon booking system 10.31 | premières → < 10.31.11 | 10.31.11 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Salon booking system
Les 21 CVE de Salon booking system →
CVE-2026-110034
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a…
3.7
Faible
CVE-2026-110031
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role…
7.2
Élevée
CVE-2026-110033
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching…
6.8
Moyenne
CVE-2026-110035
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon…
4.3
Moyenne