CVE-2026-110032 Overview
CVE-2026-110032 is a broken access control vulnerability [CWE-863] in the Salon Booking System WordPress plugin before version 10.31.11. The plugin fails to restrict which user accounts its salon staff roles may edit through the customers management screen. Users holding the Salon Staff or Salon Worker role can reset any other user's role, including administrators, to a customer. They can also overwrite arbitrary profile fields on any account. This leads to loss of administrative access and potential site lockout.
Critical Impact
Authenticated low-privilege staff users can demote administrators and overwrite account profile fields, causing loss of administrative access across the WordPress site.
Affected Products
- Salon Booking System WordPress plugin versions prior to 10.31.11
- WordPress sites assigning the Salon Staff role
- WordPress sites assigning the Salon Worker role
Discovery Timeline
- 2026-10-18 - CVE-2026-110032 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-110032
Vulnerability Analysis
The Salon Booking System plugin exposes a customers management screen intended for salon staff to edit customer accounts. The screen does not validate the target user's role or capability before allowing edits. Any authenticated user holding the Salon Staff or Salon Worker role can submit edits against arbitrary WordPress user IDs, including the primary administrator.
The attacker can downgrade an administrator to the customer role and overwrite profile fields such as email address, display name, and other metadata. Downgrading all administrators removes privileged access to the WordPress dashboard. Site owners may be fully locked out and forced to recover access through database or hosting provider intervention.
The flaw is categorized under CWE-863: Incorrect Authorization. It requires authentication as a staff-level user but no user interaction from the victim.
Root Cause
The plugin performs capability checks that confirm the acting user holds a salon staff role, but it does not verify that the target user ID belongs to a customer. The authorization logic treats staff-level editors as trusted for all user IDs rather than scoping access to legitimate customer records.
Attack Vector
An attacker authenticates to WordPress using a Salon Staff or Salon Worker account. The attacker then issues a POST request to the plugin's customer edit endpoint with the user_id parameter set to an administrator account. The request includes a role field set to customer and optionally overwrites email, name, or password reset fields. The server processes the change without re-validating the target's role, completing the privilege demotion.
For technical details, see the WPScan Vulnerability Report.
Detection Methods for CVE-2026-110032
Indicators of Compromise
- WordPress wp_usermeta or wp_users records showing administrator accounts changed to the customer role
- Unexpected profile field modifications on administrator accounts initiated by Salon Staff or Salon Worker users
- Audit log entries showing user-edit actions from salon staff accounts targeting non-customer user IDs
- Sudden inability of administrators to access /wp-admin/ after staff-account activity
Detection Strategies
- Review WordPress role change events in audit logs, correlating actor role with target role
- Alert on any user-edit request where the acting user holds salon_staff or salon_worker and the target holds administrator
- Baseline the number of accounts holding the administrator role and alert on decreases
Monitoring Recommendations
- Enable a WordPress activity logging plugin that records user role modifications and profile edits
- Forward WordPress audit logs to a centralized SIEM for correlation with authentication events
- Monitor plugin version inventory to confirm Salon Booking System is at or above 10.31.11
How to Mitigate CVE-2026-110032
Immediate Actions Required
- Update the Salon Booking System plugin to version 10.31.11 or later
- Audit all accounts assigned the Salon Staff and Salon Worker roles and remove unnecessary access
- Verify the current list of administrator accounts and restore any that were demoted
- Reset credentials for any administrator account whose profile fields were modified
Patch Information
The vendor addressed the issue in Salon Booking System version 10.31.11. The fix restricts the customers management screen so staff roles can only edit accounts holding the customer role. Refer to the WPScan Vulnerability Report for release details.
Workarounds
- Temporarily remove the Salon Staff and Salon Worker roles from all users until the patch is applied
- Restrict access to /wp-admin/users.php and plugin customer management endpoints via web server rules
- Enforce multi-factor authentication on all administrator accounts to limit downstream account takeover
- Maintain an out-of-band administrator account whose credentials are stored offline for recovery
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
