Salon Booking System CVE-2026-15070

Exploitation requires that a logged-in WordPress administrator (someone authorized to trigger the setCustomText AJAX action) be tricked into performing an action such as clicking an attacker-supplied link or visiting a malicious page while authenticated - this admin interaction is mandatory (CVSS UI:R) and is the primary limiting factor. The attacker themselves needs no account (PR:N) and no special server configuration: any default install of the Salon Booking System - Free Version plugin at version ≤ 10.30.32 is vulnerable because the flaw is missing/incorrect nonce validation on the setCustomText handler plus insufficient sanitization that fails to neutralize ' ( ) ; $ and [] characters, and the plugin directory must be web-accessible for the written translate-constants.php to be reachable and executed. The window closes if the admin is not logged in when the forged request fires.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) accurately captures a network-reachable, low-complexity flaw with no attacker authentication (PR:N) but mandatory administrator interaction (UI:R) that yields full confidentiality, integrity, and availability loss via code execution. The UI:R requirement is the dominant limiting factor: exploitation is not automatable/wormable at scale because it depends on social-engineering a specific privileged user, which is why an EPSS-style mass-exploitation signal would be expected to be low. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so this is not confirmed as actively exploited - it is a genuinely high-impact CSRF-to-RCE that in practice ranks as a targeted rather than spray-and-pray threat. Priority is high for any site running the plugin, but the practical bar (tricking an admin) is meaningfully higher than a pure unauthenticated RCE.

An attacker crafts a malicious web page or email link containing a hidden auto-submitting form that POSTs a setCustomText request with a 'value' payload engineered to break out of the PHP string literal (using quotes, parentheses, $ and semicolons). When a logged-in site administrator visits the page, their browser silently sends the forged request with valid session cookies, causing the plugin to write attacker PHP into translate-constants.php. The attacker then requests that file directly to execute their code on the server. No public POC is identified at time of analysis.