CVE-2026-15070 is a high-severity CSRF vulnerability in the Salon Booking System – Free Version WordPress plugin (up to and including version 10.30.32). The vulnerability is caused by missing or incorrect nonce validation on the setCustomText function, which allows unauthenticated attackers to inject arbitrary PHP code into the translate-constants.php file within the plugin directory. The injection occurs because the sanitize_text_field() function does not neutralize certain characters that enable breaking out of the PHP string literal before the data is written to disk. Successful exploitation requires tricking a site administrator into performing an action via a forged request, enabling remote code execution on the server.

An attacker can achieve remote code execution on the affected server by exploiting this CSRF vulnerability, which allows arbitrary PHP code injection into a web-accessible file. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction from an administrator, but no prior authentication is needed for the attacker to initiate the exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider disabling or removing the affected plugin version. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.