CVE-2026-110014: Salon Booking System Auth Bypass Flaw

CVE-2026-110014 Overview

CVE-2026-110014 affects the Salon Booking System WordPress plugin in versions before 10.31.9. The plugin fails to verify authorization before creating bookings and trusts caller-supplied values for the user identifier and booking status. Unauthenticated attackers can create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without processing any payment. The flaw is classified as Missing Authorization [CWE-862] and is exploitable remotely over the network without user interaction.

Critical Impact

Unauthenticated attackers can forge bookings, alter stored customer contact data, and bypass payment validation by abusing the booking creation endpoint.

Affected Products

• Salon Booking System WordPress plugin versions prior to 10.31.9

Discovery Timeline

• 2026-10-16 - CVE-2026-110014 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110014

Vulnerability Analysis

The Salon Booking System plugin exposes a booking creation flow that accepts user-controlled parameters without enforcing server-side authorization checks. The handler trusts the caller to supply both the target user identifier and the booking status, which permits an unauthenticated client to act on behalf of any registered user. Because the status field is honored directly, an attacker can submit requests that mark bookings as paid or confirmed without any payment gateway interaction.

The impact extends beyond free bookings. The same code path updates the stored contact details associated with the referenced user identifier, which allows attackers to overwrite legitimate customer records with attacker-controlled values. This creates integrity damage to the booking database and can be leveraged to redirect customer communications.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The booking endpoint does not call a capability check such as current_user_can() and does not validate that the authenticated session matches the submitted user identifier. The booking status is also accepted from the request body rather than being derived from the server-side payment workflow.

Attack Vector

Exploitation requires only network access to the WordPress site hosting the vulnerable plugin. An attacker crafts an HTTP request to the booking creation endpoint, supplies an arbitrary user identifier and a status value such as paid or confirmed, and overwrites the targeted user's contact details in the same request. No credentials, privileges, or user interaction are needed. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-110014

Indicators of Compromise

• Booking records marked as paid or confirmed with no corresponding transaction in the payment gateway logs.
• Sudden changes to stored customer contact fields (email, phone, address) that users did not initiate.
• Unauthenticated POST requests to the Salon Booking System plugin's booking creation endpoint from a single source address.

Detection Strategies

• Review web server access logs for anomalous request volume targeting the plugin's AJAX or REST endpoints.
• Reconcile booking status changes against payment processor records to surface bookings confirmed without a matching charge.
• Audit the WordPress users and booking tables for recent contact detail modifications tied to booking creation events.

Monitoring Recommendations

• Enable WordPress audit logging to capture user metadata changes and booking state transitions.
• Forward web and application logs to a centralized analytics platform to correlate payment gateway events with booking status changes.
• Alert on unauthenticated requests that successfully create or modify booking records.

How to Mitigate CVE-2026-110014

Immediate Actions Required

• Update the Salon Booking System WordPress plugin to version 10.31.9 or later.
• Audit existing bookings and user contact records for unauthorized modifications since the plugin was installed.
• Reconcile recent paid and confirmed bookings against payment gateway settlements.

Patch Information

The vendor addressed the issue in Salon Booking System version 10.31.9. The fix enforces authorization and ignores caller-supplied status values for new bookings. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Restrict access to the plugin's booking endpoints at the web application firewall until the patch is applied.
• Temporarily disable the Salon Booking System plugin on sites that cannot be updated immediately.
• Require authentication at the reverse proxy layer for the plugin's AJAX and REST routes where feasible.

# Configuration example
wp plugin update salon-booking-system --version=10.31.9