Vulnerabilities / Salon Booking System – Appointment Booking for Salons, Barbershops & Spas / WPSEC-2026-1093
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Cross-Site Request Forgery to Arbitrary User Deletion
High 8.1
CWE-352Fixed in 10.31.11
- ID
- WPSEC-2026-1093
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.11
- Remediation
- Update to 10.31.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.31.10. This is due to missing nonce validation on the customers list bulk delete action. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including administrators, via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1093/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS