CVE-2026-15070 is a CSRF vulnerability in the Salon Booking System – Free Version WordPress plugin (<=10.30.32). The issue is due to missing or incorrect nonce validation on the setCustomText function, which allows unauthenticated attackers to inject arbitrary PHP code into the translate-constants.php file. The POST 'value' parameter is sanitized with sanitize_text_field(), but this does not prevent injection of characters that can break out of the PHP string literal, enabling remote code execution via file_put_contents(). Exploitation requires tricking a site administrator into performing an action via a forged request.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server by injecting code into a web-accessible plugin file. This leads to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impacts. The vulnerability requires user interaction from an administrator but does not require prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links or performing untrusted actions related to the plugin. Monitoring for plugin updates from wordpresschef is recommended to apply any forthcoming patches promptly.