CVE-2026-110032 Salon Booking System CVE debrief

Who should care

Defenders responsible for WordPress installations using the Salon Booking System plugin, particularly those with administrative accounts exposed to salon staff or worker roles, should assess their exposure and take steps to restrict editing capabilities and monitor for suspicious activity.

Why it matters

This vulnerability allows users with limited roles to reset administrative accounts and overwrite profile fields, potentially leading to site lockout and loss of administrative access. Defenders should verify the presence of this vulnerability, assess exposure, and restrict editing capabilities to prevent exploitation.

• Potential loss of administrative access
• Possible site lockout due to overwritten profile fields
• Need for verification of affected versions and remediation
• Requirement for monitoring and restricting salon staff or worker roles

Technical summary

The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, potentially leading to loss of administrative access and site lockout. This highlights the need for defenders to assess their exposure and restrict editing capabilities to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of administrative accounts to salon staff or worker roles.

Recommended defensive actions

• Verify the presence of this vulnerability in WordPress installations
• Assess exposure of administrative accounts to salon staff or worker roles
• Restrict editing capabilities of salon staff or worker roles
• Monitor for suspicious role reset or profile field overwrite activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan. Defenders should verify the presence of this vulnerability in WordPress installations and assess exposure of administrative accounts to salon staff or worker roles, noting that source details are limited and may require additional verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.