CVE-2026-110015None▾ SunlitThe Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing una…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
salon_booking_system < 10.31.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110014NoneSalon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
CVE-2026-110012NoneSalon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
CVE-2026-110013NoneSalon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
CVE-2025-15405Medium· 4.3A vulnerability was detected in PHPEMS up to 11.0
CVE-2025-11051Medium· 4.3A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0
CVE-2025-11029Medium· 4.3A weakness has been identified in givanz Vvveb up to 1.0.7.2