CVE-2026-110032 Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
Salon Staff or Worker users can demote administrators to customers, causing loss of administrative access and potential site lockout.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110032?
CVE-2026-110032 is a medium-severity vulnerability in Unknown Salon Booking System, published on 18 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
Weakness: CWE-863
Which versions are affected by CVE-2026-110032?
How do I fix CVE-2026-110032?
No fix has been published for CVE-2026-110032 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110032 being exploited?
There is no known exploitation of CVE-2026-110032 in the wild and no public exploit code.
Sources
Also known as GHSA-v936-49xf-58f5.