Junglewise Threat Intelligence

CVE-2026-15070: Salon Booking System CSRF to Remote Code Execution

CVE-2026-15070 · Severity: high · CVSS 8.8 · Published 2026-07-10

Executive brief

The Salon Booking System plugin for WordPress, used to manage appointments and customer bookings, contains a security flaw that could allow an attacker to take over the website's server. By tricking a site administrator into clicking a malicious link, an attacker can remotely inject and execute unauthorized code. This could lead to a total compromise of the website, including the theft of customer data or the disruption of business operations.

Technical details

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation on the setCustomText function. An unauthenticated attacker can exploit this by tricking an administrator into submitting a forged request. The vulnerability allows the injection of arbitrary PHP code into the 'translate-constants.php' file. While sanitize_text_field() is used on the input, it fails to neutralize characters like single quotes and semicolons, allowing an attacker to break out of the PHP string literal and achieve remote code execution (RCE). The issue is present in versions up to and including 10.30.32.

Affected products

  • wordpresschef Salon Booking System – Free Version up to, and including, 10.30.32

Timeline

  • 2026-07-10: advisory: Vulnerability published by Wordfence and NVD.

References