CVE-2026-110031
7.2HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-269
Impact
Authenticated attackers with the custom salon staff role can escalate any account to administrator and take over the WordPress site. They only need access to a salon staff account to modify customer capabilities.
Root cause
The plugin fails to restrict capability assignment when a user with the salon staff role edits a customer profile.
Affected systems
Salon Booking System WordPress plugin before 10.31.11
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the Salon Booking System plugin to version 10.31.11 or later. If updating immediately is not possible, deactivate the plugin or revoke access for all untrusted salon staff accounts.
$ wp plugin update salon-booking-system --version=10.31.11AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.