CVE-2026-110015
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
- Score
- CVSS 3.1 8.8 High
- Status
- Deferred - contact@wpscan.com
- Published
- 2026-10-16
- Last modified
- 2026-10-16
- Weaknesses
- CWE-352
Affected products
References
- https://wpscan.com/vulnerability/755ad5f7-44bb-45a9-9de2-f280586deaa3/
