CVE-2026-110015— Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
Quick assessment
Affected
Unknown Salon Booking System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 10.31.9 版本之前的 Salon Booking System WordPress 插件未能正确验证 REST API 请求的真实性，并且针对整个 REST API 中通过 Cookie 进行身份验证的会话，丢弃了 WordPress 核心提供的 nonce（一次性令牌）检查。这使得未认证的攻击者能够诱使已登录的管理员点击精心构造的链接，从而在该管理员的浏览器中伪造请求，最严重的情况下可创建新的管理员账户。
Possible ATT&CK Techniques 2 AI
T1566.003 · Spearphishing via Service T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Salon Booking System | < 10.31.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110015
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Salon Booking System | 0 ~ 10.31.9 | - |
|
II. Public POCs for CVE-2026-110015
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110015
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-16 · 18 CVEs total
| CVE-2026-110029 | 5.4 MEDIUM | Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment |
| CVE-2026-109930 | 5.3 MEDIUM | MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key |
| CVE-2026-91833 | WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter | |
| CVE-2026-91830 | Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via | |
| CVE-2026-92427 | Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhoo | |
| CVE-2026-74923 | Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_genera | |
| CVE-2026-110012 | Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upco | |
| CVE-2026-110013 | Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Acc | |
| CVE-2026-109982 | MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via | |
| CVE-2026-105973 | Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Autho | |
| CVE-2026-105974 | Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget | |
| CVE-2026-103696 | Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter | |
| CVE-2026-110039 | Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite | |
| CVE-2026-110135 | OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute | |
| CVE-2026-110179 | affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter | |
| CVE-2026-110014 | Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer | |
| CVE-2026-110191 | Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disc |
IV. Related Vulnerabilities
Same product: Salon Booking System
-
CVE-2026-110014
Salon Booking System < 10.31.9 - Unauthenticated Booking Cre -
CVE-2026-110013
Salon Booking System < 10.31.9 - Unauthenticated Salon REST -
CVE-2026-110012
Salon Booking System < 10.31.3 - Subscriber+ Booking PII Dis -
CVE-2026-94668
WordPress Salon booking system plugin <= 10.31.5 - Cross Sit -
CVE-2026-105070
WordPress Salon booking system plugin <= 10.31.7 - Privilege
Same vendor: Unknown
-
CVE-2026-110527
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creat -
CVE-2026-97314
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affi -
CVE-2026-81344
Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object -
CVE-2026-81343
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated AC -
CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF
V. Comments for CVE-2026-110015
No comments yet