CVE-2026-110014
Received Received - Intake

Unauthenticated Booking Creation in Salon Booking System

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110014
EUVD
EUVD-2026-102693

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Salon Booking System 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Salon Booking System WordPress plugin before version 10.31.9 has a vulnerability where it does not verify authorization properly when creating bookings. Attackers can exploit this by supplying arbitrary user IDs and booking statuses to create bookings under any user's name, overwrite their contact details, and falsely mark bookings as paid or confirmed without payment.

Detection Guidance

Check if your Salon Booking System plugin version is below 10.31.9. Look for unauthorized bookings or modified user contact details in the WordPress admin panel. Monitor for bookings marked as paid or confirmed without corresponding transactions.

Impact Analysis

This vulnerability allows unauthenticated attackers to manipulate bookings by creating fake entries under your name, changing your contact information, and marking unpaid bookings as paid or confirmed. This could lead to confusion, financial discrepancies, and potential misuse of your account.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized changes to user data, potentially violating data integrity and privacy requirements under GDPR and HIPAA. Unauthorized modifications to contact details or booking statuses may lead to non-compliance with data protection and record-keeping regulations.

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.9 or later immediately. Review all recent bookings for unauthorized changes. Remove any suspicious bookings and restore affected user contact details.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart