{"id":"CVE-2026-110015","published":"2026-10-16T07:17:10.470","lastModified":"2026-10-16T15:17:09.097","description":"The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/755ad5f7-44bb-45a9-9de2-f280586deaa3/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}