CVE-2026-110014 — Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

CVE-2026-110014

Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status PUBLISHED

Description (CNA)

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

Affected (CNA)

Vendor / product	Versions
Unknown / Salon Booking System	affected 0 before 10.31.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/91598659-022c-4e04-ad16-399e11081053/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.