Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Missing Authorization to Administrator Demotion and Arbitrary User Deletion
- ID
- WPSEC-2026-1096
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.11
- Remediation
- Update to 10.31.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to unauthorized modification and deletion of user accounts in all versions up to, and including, 10.31.10. This is due to missing checks on the target user in the admin customer editor, the customers list bulk delete action and the booking save handler. This makes it possible for authenticated attackers with salon management access (manage_salon, held by the Salon Staff role and, when enabled, the Sln worker role) to demote administrators to the customer role, delete any user account including administrators, and change the email address of other non-administrator accounts, such as editors, and take them over through a password reset.
References
- https://wpsec.com/vuln/WPSEC-2026-1096/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS