# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Cross-Site Request Forgery to Arbitrary User Deletion

- **ID:** WPSEC-2026-1093
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.11
- **Fixed in:** 10.31.11 (Update to 10.31.11 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1093/

## Description

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.31.10. This is due to missing nonce validation on the customers list bulk delete action. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including administrators, via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1093/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1093/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.