Salon Booking System CVE-2026-105070

Exploitation targets WordPress installations with the Salon Booking System plugin (by Dimitri Grassi) at version 10.31.7 or earlier. No authentication is required (PR:N), but the attack requires user interaction (UI:R) - meaning the attacker must induce a victim (such as a logged-in user or administrator) to trigger the vulnerable privilege-assignment flow, e.g. by visiting a crafted link or submitting a manipulated request. The limiting factors are the need for that victim interaction and the requirement that the vulnerable plugin be installed and active; sites not running this plugin or already updated past 10.31.7 are unaffected. The incorrect privilege assignment (CWE-266) is the core mechanism, so the specific exposed action is the plugin's role/capability handling during booking-account operations.

This is a credible high-priority issue but not a confirmed emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring no attacker privileges but requiring user interaction (UI:R), yielding full confidentiality, integrity, and availability impact via privilege escalation (CWE-266, incorrect privilege assignment). The signals are partially incomplete and partially in tension: there is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score and no SSVC decision data were supplied, so automatability and real-world exploitation probability cannot be quantified from the input. The 'Unauthenticated Privilege Escalation' label (PR:N) combined with the UI:R requirement is mildly conflicting - PR:N confirms no authentication is needed, but UI:R means the attack still depends on a victim performing some action, which lowers practical likelihood versus a fully no-interaction remote flaw. Net: treat as a serious patch-soon vulnerability for any site running the affected plugin, but the absence of KEV/POC/EPSS signals suggests it is not yet subject to mass automated exploitation. Verify exploitation prerequisites with the Patchstack advisory.

A remote, unauthenticated attacker crafts a malicious request or link targeting a WordPress site running Salon Booking System <= 10.31.7 and lures a user into triggering it (UI:R), causing the plugin to assign the attacker or victim account elevated privileges. No public proof-of-concept was identified in the provided data, so exploitation details are inferred from the CVSS vector and CWE-266 classification rather than a released exploit.