UNKNOWN NVD

CVE-2026-110014

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user iden

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.

References

https://wpscan.com/vulnerability/91598659-022c-4e04-ad16-399e11081053/

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This unknown severity vulnerability was published on 2026-10-16 via NVD.

vulnfeed aggregates 14996 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.