CVE-2026-15070: Salon Booking System CSRF Vulnerability

CVE-2026-15070 Overview

CVE-2026-15070 is a Cross-Site Request Forgery [CWE-352] vulnerability in the Salon Booking System – Free Version plugin for WordPress, affecting all versions up to and including 10.30.32. The flaw resides in the setCustomText function, which lacks proper nonce validation. An unauthenticated attacker who tricks a site administrator into clicking a crafted link can inject arbitrary PHP code into the web-accessible translate-constants.php file inside the plugin directory. This chain converts a client-side request forgery into full remote code execution on the server.

Critical Impact
A single administrator click on an attacker-controlled link results in arbitrary PHP execution on the WordPress server, leading to full site and potentially host compromise.

Affected Products

Salon Booking System – Free Version plugin for WordPress
All versions up to and including 10.30.32
WordPress sites with administrators who can be socially engineered into clicking external links

Discovery Timeline

2026-07-10 - CVE-2026-15070 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15070

Vulnerability Analysis

The vulnerability chains a missing CSRF check with unsafe file writes to achieve remote code execution. The setCustomText AJAX handler in src/SLN/Action/Ajax/SetCustomText.php processes administrator requests to customize translation strings but does not validate a WordPress nonce. Because the endpoint accepts requests based only on the victim's authenticated session cookie, any cross-origin request initiated by an administrator's browser is honored.

The handler writes the submitted value into translate-constants.php inside the plugin directory. That file is web-accessible and interpreted as PHP, so any injected code executes on the next request to it. The result is unauthenticated remote code execution gated only by a single administrator interaction.

Root Cause

Two defects combine to produce the impact. First, setCustomText omits check_ajax_referer() or an equivalent nonce verification, violating WordPress CSRF protection guidance. Second, sanitize_text_field() is applied to the POST value parameter but does not neutralize single quotes, parentheses, semicolons, $, or [] — the characters required to break out of the PHP string literal into which the value is interpolated before being written via file_put_contents(). Sanitization intended for display context is misused as a code-safety boundary.

Attack Vector

An attacker hosts a page containing a hidden form or fetch() call targeting the vulnerable AJAX endpoint on the victim's WordPress site. When a logged-in administrator visits the attacker's page, the browser submits the forged request with the administrator's cookies. The value parameter contains a payload that terminates the surrounding PHP string literal and appends attacker-controlled PHP. Once written to translate-constants.php, the attacker fetches that file directly to trigger execution. See the Wordfence Vulnerability Report and the plugin source in SetCustomText.php for technical detail.

Detection Methods for CVE-2026-15070

Indicators of Compromise

Unexpected modifications to wp-content/plugins/salon-booking-system/translate-constants.php, especially content containing PHP tags, backticks, or calls to system, exec, passthru, eval, or assert.
HTTP POST requests to admin-ajax.php with action=sln-set-custom-text originating from external referrers.
Direct HTTP GET requests to translate-constants.php from unusual IP addresses following a POST to the AJAX endpoint.
New PHP files, webshells, or scheduled tasks appearing under wp-content/ shortly after administrator web sessions.

Detection Strategies

Monitor file integrity on all files inside wp-content/plugins/salon-booking-system/ and alert on writes to translate-constants.php.
Inspect web server logs for POST requests to admin-ajax.php where the Referer header points to an external domain and the action parameter targets sln-set-custom-text.
Alert on outbound network connections from the PHP worker process (php-fpm, httpd) to unexpected destinations following writes to plugin translation files.

Monitoring Recommendations

Enable WordPress audit logging for administrator sessions and correlate with file-write events on disk.
Deploy a Web Application Firewall (WAF) rule to require a valid nonce on requests to sln-set-custom-text or block the action outright until the plugin is patched.
Review scheduled scans of the plugin directory for PHP files whose content includes suspicious functions or base64-encoded blobs.

How to Mitigate CVE-2026-15070

Immediate Actions Required

Update the Salon Booking System – Free Version plugin to a version released after 10.30.32 that includes the fix referenced in the plugin changeset.
If no patched version is available, deactivate and remove the plugin from all affected WordPress sites.
Inspect translate-constants.php and the wider plugin directory for signs of tampering and restore from a known-good backup if modifications are found.
Rotate WordPress administrator credentials and any secrets stored in wp-config.php if compromise is suspected.

Patch Information

The vendor addressed the flaw in the plugin changeset published at plugins.trac.wordpress.org. The corrected handler enforces nonce validation on the setCustomText action and revises how translation values are persisted so that user input cannot break out of the PHP string context in translate-constants.php. Administrators should upgrade through the WordPress admin dashboard or WP-CLI as soon as the fixed release is available.

Workarounds

Block direct HTTP access to wp-content/plugins/salon-booking-system/translate-constants.php at the web server or WAF layer.
Restrict access to wp-admin/admin-ajax.php for administrator-only actions using IP allowlisting where feasible.
Enforce browser-side protections by requiring administrators to use isolated browser profiles or sessions when managing WordPress.
Add a WAF signature that drops POST requests to admin-ajax.php with action=sln-set-custom-text when no valid _wpnonce parameter is present.

bash

# Example nginx rule to block direct execution of the abused file
location ~* /wp-content/plugins/salon-booking-system/translate-constants\.php$ {
    deny all;
    return 403;
}