CVE-2026-110015 Overview
CVE-2026-110015 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Salon Booking System WordPress plugin before version 10.31.9. The plugin fails to verify the authenticity of REST API requests and disables WordPress core's nonce check for cookie-authenticated sessions across the entire REST API surface. An unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can forge requests in that administrator's browser context. Successful exploitation allows the attacker to create a new administrator account, resulting in full site takeover.
Critical Impact
Attackers can achieve full WordPress site compromise by creating rogue administrator accounts through a single click from an authenticated admin.
Affected Products
- Salon Booking System WordPress plugin versions prior to 10.31.9
- WordPress installations with the plugin active and administrator sessions present
- Any site exposing the plugin's REST API endpoints to authenticated administrators
Discovery Timeline
- 2026-10-16 - CVE-2026-110015 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-110015
Vulnerability Analysis
The Salon Booking System plugin registers REST API routes without enforcing proper request authenticity checks. WordPress core protects cookie-authenticated REST requests using a nonce mechanism validated through the wp_rest nonce. The plugin bypasses this safeguard by discarding the nonce verification for cookie-authenticated sessions across the whole REST API scope.
This configuration transforms privileged REST endpoints into CSRF-reachable targets. An administrator with an active session becomes a usable attack vector. Exploitation requires only one interaction: clicking a link that triggers a cross-origin request to the vulnerable site.
The impact extends beyond salon-specific functionality. Because the nonce bypass affects the whole REST API, administrative actions such as creating users with the administrator role become reachable through forged requests.
Root Cause
The plugin overrides or interferes with WordPress's REST authentication pipeline in a way that drops the standard nonce check for logged-in users. This defeats the primary CSRF defense that WordPress applies to cookie-authenticated REST requests. The flaw maps to CWE-352: Cross-Site Request Forgery.
Attack Vector
The attack requires an authenticated administrator to visit an attacker-controlled page or click a malicious link while their WordPress session cookie is valid. The attacker's page issues a cross-origin request to the vulnerable WordPress REST API endpoint. Because the browser attaches the admin's session cookie and the plugin skips nonce validation, the request executes with administrator privileges.
A common exploitation path targets the user creation endpoint to provision a new account with the administrator role, granting the attacker persistent access. See the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-110015
Indicators of Compromise
- Unexpected WordPress user accounts with the administrator role, especially those created outside normal provisioning windows
- REST API POST requests to /wp-json/wp/v2/users originating from external Referer or Origin headers
- Access log entries showing authenticated REST API requests immediately after an administrator visits an external domain
- Modifications to plugin, theme, or option settings performed through REST endpoints without corresponding admin UI session activity
Detection Strategies
- Inventory active WordPress sites and flag any running Salon Booking System below version 10.31.9
- Correlate browser referrer data with REST API write operations to identify cross-origin request patterns
- Alert on new administrator account creation events and reconcile them against change management records
- Review web server logs for sequences where an admin page load is followed by REST requests lacking a valid X-WP-Nonce header
Monitoring Recommendations
- Forward WordPress audit logs and web server access logs to a centralized analytics platform for correlation
- Monitor for role escalation events and administrator account creation across all WordPress deployments
- Track outbound links clicked from administrator browser sessions when feasible through endpoint telemetry
How to Mitigate CVE-2026-110015
Immediate Actions Required
- Update the Salon Booking System plugin to version 10.31.9 or later on all WordPress installations
- Audit all WordPress user accounts and remove any unrecognized administrators
- Rotate credentials and application passwords for existing administrator accounts
- Invalidate active WordPress sessions to force re-authentication after patching
Patch Information
Upgrade to Salon Booking System version 10.31.9 or later. The vendor fix restores proper REST API nonce validation for cookie-authenticated sessions. Refer to the WPScan Vulnerability Report for vendor advisory details.
Workarounds
- Deactivate the Salon Booking System plugin until the patched version can be installed
- Restrict administrator access to the WordPress REST API using a web application firewall rule set
- Require administrators to use isolated browser profiles that do not visit untrusted external sites during active sessions
- Enforce short session lifetimes and reauthentication for sensitive REST operations through hardening plugins
# Configuration example: WP-CLI commands to patch and audit
wp plugin update salon-booking-system --version=10.31.9
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp user session destroy --all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
