Overview
CVE-2026-110031 is a privilege escalation vulnerability in the Salon Booking System WordPress plugin affecting versions v10.17 through v10.31.10 (≤ 10.31.10). The flaw carries a CVSS score of 7.2 (High), was assigned by WPScan, reserved October 13, 2026, and published October 18, 2026. It is classified under CWE-269 (Improper Privilege Management).
The vulnerability allows a user holding the plugin's custom "Salon Staff" role — a limited, operational role intended for salon employees who manage bookings, not site administration — to assign arbitrary WordPress capabilities to other accounts while editing a customer's profile, including escalating an account all the way to Administrator. WPScan's full advisory title describes it as a "Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key." The fix shipped in version 10.31.11.
A closely related flaw, CVE-2026-110032 (CWE-863, Incorrect Authorization), was disclosed against the same plugin and version range: it lets Salon Staff/Worker roles reset any user's role — including administrators — down to a customer, and overwrite arbitrary profile fields on any account. Sites patching CVE-2026-110031 should confirm their update also covers CVE-2026-110032.
Technical Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-110031 |
| Severity | High |
| CVSS Score | 7.2 |
| CWE | CWE-269 (Improper Privilege Management) |
| Plugin | Salon Booking System (WordPress) |
| Affected Versions | v10.17 through v10.31.10 (≤ 10.31.10) |
| Fixed Version | 10.31.11 |
| Required Privilege | Custom "Salon Staff" role (or higher) |
| Attack Vector | Authenticated (Salon Staff role), via the customer-editing admin screen |
| Assigner | WPScan |
| Reserved | October 13, 2026 |
| Published | October 18, 2026 |
| Related CVE | CVE-2026-110032 (Incorrect Authorization, CWE-863) — same plugin, same version range |
How It Works
Salon Booking System's Salon Staff role is designed to let employees manage bookings and customer records without full administrative access. According to WPScan's advisory, the plugin's handling of user meta keys during customer-edit operations is case-insensitive in a way the underlying authorization check doesn't account for — allowing a Salon Staff user to submit a capability-assignment key that bypasses the intended restriction on which fields they're allowed to modify.
In practice, this means a Salon Staff account — a role many salon businesses hand out to any front-desk employee — can, while editing a customer record, inject arbitrary WordPress capabilities into that customer's user meta. Because WordPress capabilities determine what an account can do (edit posts, manage plugins, manage other users, and so on), an attacker can grant the target account — potentially their own, if they also hold a customer-linked login, or any account they can edit — the full capability set of an Administrator.
This aligns with MITRE ATT&CK technique T1078 (Valid Accounts): the attacker doesn't need to steal credentials or exploit a memory-safety bug — they abuse a legitimately-issued, lower-privileged role to grant themselves (or another account) administrative control through a logic flaw in capability handling.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | Full Administrator access exposes all site content, user data, and configuration |
| Integrity | An escalated account can modify any post, page, user, or plugin setting on the site |
| Availability | Administrator access allows disabling plugins, deleting content, or taking the site offline entirely |
| Blast Radius | Any WordPress install that grants the Salon Staff role to employees — a common and expected configuration for this plugin's intended use case — has a built-in population of users who meet the attack's privilege prerequisite |
| Compounding Risk | The related CVE-2026-110032 means staff-level accounts in the same version range can also demote administrators to customers, which could be used to lock out legitimate site owners during or after an escalation attempt |
Recommendations
For Salon Booking System operators
- Update to version 10.31.11 or later immediately. This is the vendor-confirmed fix for CVE-2026-110031.
- Audit existing Salon Staff and Salon Worker accounts for unexpected capability grants or role changes made before patching, particularly any account that now holds Administrator-level capabilities unexpectedly.
- Review user accounts for role changes you did not make — check for administrators who were unexpectedly demoted, which would indicate exploitation of the related CVE-2026-110032.
- Limit who is granted the Salon Staff role to trusted employees only, as a defense-in-depth measure independent of patching.
For WordPress site administrators generally
- Treat custom plugin roles as a real privilege boundary that needs the same scrutiny as built-in WordPress roles — vulnerabilities in third-party role/capability logic are a recurring pattern in plugin ecosystems.
- Enable automatic updates for security-relevant plugins where your change-management process allows it, to reduce exposure windows for issues like this one.
Key Takeaways
- CVE-2026-110031 is a CVSS 7.2 High privilege escalation in the Salon Booking System WordPress plugin, letting Salon Staff-level users escalate accounts to Administrator.
- The root cause is a case-insensitive user meta key check that fails to restrict which capabilities a Salon Staff user can assign while editing a customer.
- Affected versions run v10.17 through v10.31.10; the fix shipped in v10.31.11.
- A related vulnerability, CVE-2026-110032, affects the same version range and lets Salon Staff/Worker roles reset any account's role, including demoting administrators.
- Sites that grant the Salon Staff role to ordinary employees — the plugin's intended use case — should treat this as an urgent update, not a routine one.