Unauthenticated Privilege Escalation in Salon Booking System

Executive Summary

CVE-2026-105070 is an unauthenticated privilege escalation vulnerability in the WordPress Salon Booking System Plugin versions 10.31.7 and earlier. It allows low-privilege users to gain admin-level access by exploiting a flaw that enables them to escalate their permissions. The vulnerability requires user interaction, such as clicking a malicious link or submitting a form, to be exploited.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses Salon Booking System Plugin version 10.31.7 or earlier. Logs may show unusual admin-level actions from low-privilege users. Use security plugins to scan for unauthorized privilege changes or suspicious user activity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to gain full control of your website by escalating their access to admin-level permissions. Since exploitation requires minimal user interaction, attackers can target thousands of websites indiscriminately. If exploited, it could lead to unauthorized data access, website defacement, or further attacks on visitors.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Salon Booking System Plugin to version 10.31.9 or later immediately. Apply Patchstack's mitigation rule if available to block attacks until the update is complete. Review user roles and permissions for unauthorized admin access.

Useful 0 Not Useful 0