Salon booking system, CVE-2026-110031

CVE, Research URL: CVE-2026-110031
Home page URL: Security reports for Salon booking system
Application: Salon booking system
Published on: Oct 18, 2026
Research Description: The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
Affected versions: Min 10.17, max 10.31.11.
Status: vulnerable