Salon Booking System: Cross-Site Request Forgery in REST API enables admin account creation
Summary
The Salon Booking System WordPress plugin before version 10.31.9 does not properly verify REST API requests from logged-in browser sessions. An unauthenticated attacker can create a crafted link that, when clicked by a logged-in administrator, forges requests in that administrator's browser. The attack can lead to creation of a new administrator account and therefore full control of the website, including booking and customer data.
Affected
- Salon Booking System WordPress plugin, all versions before 10.31.9 (VulDB lists up to 10.31.8)
Fixed in
- Version 10.31.9 (per WPScan; vendor advisory not located)
- Version 10.31.11 or later is recommended, because a separate later CVE (CVE-2026-110035) is fixed in 10.31.11
Workaround
- No workaround is needed if the plugin can be updated.
- If an update is not possible immediately, make administrators log out of WordPress when not in use and avoid browsing other sites while logged in.
- Consider deactivating the plugin on sites that cannot be patched.
Exploitation
- No public proof of concept found.
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- EPSS score 0.11% (per a GitHub triage issue, not CISA).
- VulDB labels the issue 0-Day, meaning publicly disclosed before a fix, not necessarily exploited.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update the Salon Booking System plugin to version 10.31.11 or later.
- Check all WordPress sites for this plugin, including sites that are not actively maintained.
- Review the user list for unexpected administrator accounts after patching and after any suspected phishing targeting administrators.
- Restrict administrator sessions: use separate admin accounts for daily work, log out after use, and use two-factor authentication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF wpscan.com
- VulDB: CVE-2026-110015 vuldb.com
- VulDB: vulnerability 421151 vuldb.com
- VulDB: vulnerability 421661 (fix in 10.31.11) vuldb.com
- Vulners: PT-2026-115474 index vulners.com
- GitHub triage issue (EPSS, KEV status) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:06.
Original description (NVD)
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.