Vulnerability in Salon Booking System Plugin by WordPress
CVE-2026-110015

8.8HIGH

Key Information:

Vendor

WordPress
Status
Salon Booking System
Vendor
CVE Published:
16 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-110015?

The Salon Booking System plugin for WordPress prior to version 10.31.9 includes a vulnerability that compromises the integrity of REST API request verification. This issue arises from the plugin's failure to adequately authenticate requests, as it neglects to implement WordPress's nonce verification for cookie-authenticated sessions across the entire REST API. Consequently, this flaw allows an unauthenticated attacker, with the ability to persuade a logged-in administrator to click a malicious link, to forge requests in the context of that administrator's browser. This could ultimately enable the creation of new administrator accounts, further compromising site security.

Affected Version(s)

Salon Booking System 0 < 10.31.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110015 - Proof of Concept

References

https://wpscan.com/vulnerability/755ad5f7-44bb-45a9-9de2-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael P. Cigana
WPScan
.