CVE-2026-110014

UNKNOWN 0.0

Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

Vendor	unknown
Product	salon booking system
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for unknown salon booking system

Be the first to know when new unknown vulnerabilities affecting unknown salon booking system are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Salon Booking System

0 < 10.31.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/91598659-022c-4e04-ad16-399e11081053/

Credits

Raphael P. Cigana WPScan