{
 "id": "WPSEC-2026-1094",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1094/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1094/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1094/index.md",
 "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation via Customer User Meta",
 "description": "The Salon Booking System plugin for WordPress is vulnerable to Privilege Escalation via the admin customer editor in all versions up to, and including, 10.31.10. This is due to the editor writing every submitted customer meta entry to user meta, guarded only by a weak meta key prefix denylist. This makes it possible for authenticated attackers with salon management access (manage_salon, held by the Salon Staff role and, when enabled, the Sln worker role) to update arbitrary user meta, including user capabilities, on customer accounts they create or edit, and so grant administrator privileges to an account they control.",
 "plugin": {
  "slug": "salon-booking-system",
  "name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "full_name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "wordpress_org": "https://wordpress.org/plugins/salon-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/salon-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/salon-booking-system"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "10.31.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 10.31.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "10.31.11",
 "remediation": "Update to 10.31.11 or later.",
 "fix_released": "2026-10-15T09:09:44+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T11:27:45.241656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1094/",
  "https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/",
  "https://wordpress.org/plugins/salon-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/salon-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}