CVE-2026-110032
Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
| Vendor | unknown |
| Product | salon booking system |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown salon booking system
Be the first to know when new unknown vulnerabilities affecting unknown salon booking system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Salon Booking System
0 < 10.31.11
References
Credits
Utkarsh Choudhary WPScan