User Role Management Flaw in Salon Booking System Plugin for WordPress
CVE-2026-110032
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 18 October 2026
Badges
What is CVE-2026-110032?
The Salon Booking System plugin for WordPress, prior to version 10.31.11, contains a significant flaw that permits users assigned with the Salon Staff or Salon Worker roles to modify other users' roles indiscriminately. This includes the ability to demote users, including administrators, to a customer role, which can lead to unauthorized access control and potential lockout from the administrative features of the site. Furthermore, these role changes empower salon staff to overwrite critical profile fields for any user account, heightening the risk of misuse and compromising the overall security integrity of the website.
Affected Version(s)
Salon Booking System 0 < 10.31.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.