CVE-2026-110032: CWE-863 Incorrect Authorization in Salon Booking System

CVE-2026-110032 describes an incorrect authorization vulnerability (CWE-863) in the Salon Booking System WordPress plugin versions prior to 10.31.11. The vulnerability arises because the plugin does not properly restrict which user accounts can be edited via the customers management screen by users assigned the Salon Staff or Salon Worker roles. Exploiting this, such users can reset any other user's role, including administrators, to a customer role and overwrite arbitrary profile fields on any account. This can result in loss of administrative privileges and potentially lock site administrators out of the system.

Users with Salon Staff or Salon Worker roles can downgrade administrator accounts to customer roles and modify profile data arbitrarily. This leads to loss of administrative control over the WordPress site and may cause site lockout, severely impacting site management and security.

Upgrade the Salon Booking System WordPress plugin to version 10.31.11 or later, where this authorization issue is fixed. No other mitigation is indicated by the vendor advisory.