Salon Booking System CVE-2026-110014

Exploitable against the Salon Booking System WordPress plugin at any version before 10.31.9 where the booking-creation endpoint is reachable - i.e. any public-facing site running the plugin with booking functionality exposed, which is its default/intended deployment. The specific prerequisite is that the booking-creation flow accepts a caller-supplied user identifier and booking status without an authorization check; no authentication, no user interaction, and no non-default configuration are required (PR:N/UI:N). The practical limit on impact is scope: the flaw permits only forging/reassigning bookings, overwriting victim contact details, and falsifying payment/confirmation status - it does not grant code execution, data exfiltration, or site takeover.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) and the description agree: this is a remotely reachable, unauthenticated (PR:N) missing-authorization flaw (CWE-862) with low-complexity exploitation and integrity-only impact - no confidentiality or availability loss, which is why the score stays MEDIUM despite being unauthenticated and network-facing. Publicly available exploit code exists (WPScan), but the EPSS score is low at 0.15% (3rd percentile) and the CVE is NOT listed in CISA KEV, so there is no public exploit identified as actively exploited - signals point to proof-of-concept availability rather than observed mass exploitation. No SSVC decision data was provided in the input. The signals are internally consistent (network vector, no auth, integrity-only), so there is no conflict to resolve; the main caveat is that CWE-862 (Missing Authorization) is a broader/different category than the 'Authentication Bypass' tag applied in the input. Overall this is a real but moderate-priority issue: trivially exploitable with a known POC, yet bounded to data-integrity abuse (forged/altered bookings, overwritten contact details, fraudulently 'paid' statuses) rather than server compromise or data theft.

An unauthenticated attacker sends a crafted HTTP request to the plugin's booking endpoint, supplying an arbitrary target user identifier and a booking status such as 'paid' or 'confirmed'. Because authorization is never checked, the booking is created and attributed to the victim user, their stored contact details are overwritten, and the booking is marked paid without any payment. A public POC is available via WPScan, and the low-complexity network vector (AV:N/AC:L/PR:N/UI:N) means no authentication or user interaction is required.