CVE-2026-110031 Privilege escalation in Salon Booking System
Salon staff users can escalate privileges to administrator by exploiting case-insensitive user meta keys during customer editing.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110031?
CVE-2026-110031 is a high-severity vulnerability in Unknown Salon Booking System, published on 18 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
Weakness: CWE-269
Which versions are affected by CVE-2026-110031?
How do I fix CVE-2026-110031?
No fix has been published for CVE-2026-110031 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110031 being exploited?
There is no known exploitation of CVE-2026-110031 in the wild and no public exploit code.
Sources
Also known as GHSA-wpj6-8qpm-3rhw.