Is CVE-2026-110031 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110031?

CVE-2026-110031 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-110031

Description

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.