Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation via Customer User Meta
- ID
- WPSEC-2026-1094
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.11
- Remediation
- Update to 10.31.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Privilege Escalation via the admin customer editor in all versions up to, and including, 10.31.10. This is due to the editor writing every submitted customer meta entry to user meta, guarded only by a weak meta key prefix denylist. This makes it possible for authenticated attackers with salon management access (manage_salon, held by the Salon Staff role and, when enabled, the Sln worker role) to update arbitrary user meta, including user capabilities, on customer accounts they create or edit, and so grant administrator privileges to an account they control.
References
- https://wpsec.com/vuln/WPSEC-2026-1094/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS