CVE-2026-110015: unknown salon booking system Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2026-110015 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in unknown salon booking system. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-10-2026
   PublishedVulnerability first disclosed.
2. 16-10-2026
   Last modifiedVulnerability information updated.

Description

The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.