PatchSiren cyber security CVE debrief
CVE-2026-15070 wordpresschef CVE debrief
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into the web-accessible translate-constants.php file within the plugin directory, enabling remote code execution on the server via a forged request if they can trick a site administrator into performing an action such as clicking on a link. Administrators should be aware of this vulnerability and take immediate action to protect their sites.
- Vendor
- wordpresschef
- Product
- Salon Booking System – Free Version
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-10
- Original CVE updated
- 2026-07-10
- Advisory published
- 2026-07-10
- Advisory updated
- 2026-07-10
Who should care
Administrators of WordPress installations with the Salon Booking System – Free Version plugin installed should be aware of this vulnerability and take immediate action to protect their sites. They should review the official CVE record and NVD entry for further details and implement additional security measures to prevent exploitation.
Technical summary
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the setCustomText function. An attacker can exploit this vulnerability by tricking a site administrator into performing an action such as clicking on a link, allowing the attacker to inject arbitrary PHP code into the web-accessible translate-constants.php file within the plugin directory, enabling remote code execution on the server. The vulnerability affects all versions up to, and including, 10.30.32.
Defensive priority
High
Recommended defensive actions
- Update the Salon Booking System – Free Version plugin to the latest version.
- Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent CSRF attacks.
- Monitor your WordPress installation for suspicious activity.
- Educate site administrators on the risks of CSRF attacks and the importance of being cautious when clicking on links.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-10T04:17:47.727Z and was last modified on 2026-07-10T16:16:25.573Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify affected deployments, review official advisories, and plan updates or mitigations. Additional sources may provide further details.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-10T04:17:47.727Z and has not been modified since then. The NVD entry is currently Deferred.