{
 "id": "WPSEC-2026-1093",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1093/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1093/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1093/index.md",
 "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Cross-Site Request Forgery to Arbitrary User Deletion",
 "description": "The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.31.10. This is due to missing nonce validation on the customers list bulk delete action. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including administrators, via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "salon-booking-system",
  "name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "full_name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "wordpress_org": "https://wordpress.org/plugins/salon-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/salon-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/salon-booking-system"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "10.31.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 10.31.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "10.31.11",
 "remediation": "Update to 10.31.11 or later.",
 "fix_released": "2026-10-15T09:09:44+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T11:27:45.241656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1093/",
  "https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/",
  "https://wordpress.org/plugins/salon-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/salon-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}