CVE-2026-110014 in Salon Booking System Plugin
Summary
by MITRE • 10/16/2026
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the Salon Booking System WordPress plugin prior to version 10.31.9 represents a critical failure in access control mechanisms, specifically manifesting as an insecure direct object reference combined with insufficient authorization checks during booking creation processes. This flaw allows unauthenticated attackers to bypass standard authentication requirements by manipulating request parameters that dictate user identity and transaction status. The core technical issue lies in the plugin's reliance on caller-supplied data for sensitive operations without validating whether the requesting entity possesses the necessary privileges or ownership rights over the target resources. By trusting a user identifier provided directly in the HTTP request, the application fails to verify if the current session or IP address is legitimately associated with that account, thereby enabling privilege escalation and identity spoofing at the application logic level.
From an operational perspective, this vulnerability grants malicious actors significant control over the booking system's data integrity and business workflows. Attackers can create bookings under arbitrary user accounts, effectively impersonating legitimate customers without possessing their credentials. This capability extends to modifying stored contact details associated with these users, which poses a severe risk to personal identifiable information privacy and could be leveraged for further social engineering attacks or account takeover attempts by overwriting email addresses or phone numbers linked to the compromised profiles. Furthermore, the ability to mark bookings as paid or confirmed without actual payment processing undermines the financial integrity of the business operations managed through this plugin. This allows attackers to generate false revenue records, disrupt scheduling systems, and potentially cause operational chaos for salon staff who rely on accurate booking statuses for resource allocation and customer management.
The technical classification of this vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-284 Improper Access Control and CWE-915 Improper Modification of Objects by Unauthorized Users. The exploitation vector typically involves crafting specific HTTP POST requests that include manipulated user ID parameters and status flags, bypassing the server-side validation logic intended to restrict these actions to authenticated users with appropriate permissions. This behavior is consistent with attack patterns documented in the MITRE ATT&CK framework, particularly under techniques related to Account Manipulation and Defense Evasion, where adversaries modify system configurations or data to maintain access or obscure their activities. The lack of proper session verification means that even anonymous visitors can interact with endpoints designed for authenticated users, exploiting the trust placed in client-side inputs without server-side validation of ownership.
Mitigation strategies must prioritize immediate patching to version 10.31.9 or later, where these authorization checks have been reinforced. In addition to updating the software, administrators should implement strict input validation and ensure that all sensitive operations require verified session tokens tied to specific user identities rather than relying on mutable request parameters for identity resolution. Web Application Firewalls can be configured to detect anomalous patterns in booking creation requests, such as sudden spikes from unauthenticated IPs or attempts to modify fields related to payment status without corresponding transaction IDs. Regular security audits focusing on access control logic and continuous monitoring of system logs for unauthorized modification events are essential to maintaining the integrity of the booking infrastructure against similar exploitation attempts.