# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Missing Authorization to Administrator Demotion and Arbitrary User Deletion

- **ID:** WPSEC-2026-1096
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.11
- **Fixed in:** 10.31.11 (Update to 10.31.11 or later.)
- **Severity:** Medium 6.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1096/

## Description

The Salon Booking System plugin for WordPress is vulnerable to unauthorized modification and deletion of user accounts in all versions up to, and including, 10.31.10. This is due to missing checks on the target user in the admin customer editor, the customers list bulk delete action and the booking save handler. This makes it possible for authenticated attackers with salon management access (manage_salon, held by the Salon Staff role and, when enabled, the Sln worker role) to demote administrators to the customer role, delete any user account including administrators, and change the email address of other non-administrator accounts, such as editors, and take them over through a password reset.

## References

- https://wpsec.com/vuln/WPSEC-2026-1096/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1096/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.