CVE-2026-110015 in Salon Booking System Plugin
Summary
by MITRE • 10/16/2026
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Salon Booking System plugin for WordPress, prior to version 10.31.9, contains a critical authentication bypass vulnerability within its REST API implementation. This flaw stems from an incorrect verification of request authenticity and the deliberate discarding of standard security mechanisms provided by the WordPress core framework. Specifically, the plugin fails to validate nonces for cookie-authenticated sessions across all exposed endpoints in its custom REST API routes. In standard WordPress architecture, a nonce (number used once) is generated upon page load and must be included with subsequent state-changing requests to prove that the request originated from an authenticated user who intended to perform that action. By ignoring this check, the plugin effectively removes one of the primary defenses against Cross-Site Request Forgery attacks for any functionality accessible through its API endpoints.
This technical deficiency allows unauthenticated attackers to forge requests on behalf of logged-in administrators if they can trick them into clicking a crafted link or loading a malicious page containing automated request scripts. This scenario aligns with the Common Weakness Enumeration CWE-352, which describes Cross-Site Request Forgery as a weakness where an attacker induces a user to perform actions that change their state on a trusted website without their consent. Because the REST API endpoints do not properly enforce session validation through nonces, any request sent from the victim's browser with valid cookies will be accepted by the server as legitimate, regardless of whether it was initiated by the administrator or injected via malicious JavaScript triggered by an external site.
The operational impact of this vulnerability is severe due to the high privilege level typically associated with WordPress administrators. An attacker who successfully exploits this flaw can perform any action available through the affected REST API endpoints using the victim's administrative credentials. This includes, but is not limited to, modifying plugin settings, deleting content, and creating new user accounts with administrator privileges. The ability to create a new administrator account provides persistent access to the compromised system, allowing the attacker to maintain control even if other security measures are tightened or passwords are changed for existing users.
From an adversary perspective, this vulnerability facilitates initial compromise through social engineering tactics such as phishing, where victims are lured into visiting malicious sites that trigger the forged requests in their background sessions. This aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse and Account Manipulation, specifically T1059 for command execution via scripts or APIs, and T1136 for creating accounts to maintain access. The lack of proper request validation means that the attacker does not need prior knowledge of session tokens beyond what is automatically sent by the browser with every request to a WordPress domain, significantly lowering the barrier for exploitation.
To mitigate this vulnerability, administrators must immediately update the Salon Booking System plugin to version 10.31.9 or later, where these authentication checks have been corrected. Until an update is applied, it is advisable to restrict access to the WordPress admin area using IP whitelisting if possible and to monitor for unusual user creation events in the system logs. Additionally, implementing strict Content Security Policy headers can help mitigate the risk of cross-site scripting attacks that might be used to trigger these forged requests by limiting the sources from which scripts can execute within the browser environment. Regular security audits focusing on REST API endpoint validation are recommended to ensure similar flaws do not exist elsewhere in the application logic.