Unrated severityNVD Advisory· Published Oct 16, 2026

CVE-2026-110014

Description

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Salon Booking Systemllm-fuzzy
Range: <10.31.9
Package: https://wordpress.org/plugins/salon-booking-system

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/91598659-022c-4e04-ad16-399e11081053/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000