# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation via Customer User Meta

- **ID:** WPSEC-2026-1094
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.11
- **Fixed in:** 10.31.11 (Update to 10.31.11 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1094/

## Description

The Salon Booking System plugin for WordPress is vulnerable to Privilege Escalation via the admin customer editor in all versions up to, and including, 10.31.10. This is due to the editor writing every submitted customer meta entry to user meta, guarded only by a weak meta key prefix denylist. This makes it possible for authenticated attackers with salon management access (manage_salon, held by the Salon Staff role and, when enabled, the Sln worker role) to update arbitrary user meta, including user capabilities, on customer accounts they create or edit, and so grant administrator privileges to an account they control.

## References

- https://wpsec.com/vuln/WPSEC-2026-1094/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1094/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.