high7.2
CVE-2026-110031
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to o…
Impact
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
Affected products
| Product | Affected versions |
|---|---|
| Salon Booking System WordPress Plugin | before 10.31.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.