CVE-2026-15070: Salon Booking System WordPress Plugin Remote Code Execution via CSRF

Technical summary

CVE-2026-15070 is a Cross-Site Request Forgery (CSRF) vulnerability combined with insufficient input sanitization in the Salon Booking System – Free Version plugin for WordPress (all versions up to 10.30.32). The setCustomText function lacks proper nonce validation, allowing unauthenticated attackers to submit forged POST requests that write arbitrary content to translate-constants.php. Although sanitize_text_field() is applied to the 'value' parameter, it fails to neutralize characters critical to PHP syntax escape (single quotes, parentheses, semicolons, dollar signs, and square brackets). This permits attackers to break out of the intended string literal context and inject executable PHP code, which is then persisted to disk via file_put_contents() and executed server-side. The attack requires user interaction (UI:R) but no privilege escalation.

Business impact

Remote code execution on affected WordPress sites creates severe operational and security risk. Attackers gain the ability to modify site content, exfiltrate sensitive data, install backdoors, deface the website, or pivot to other systems on the network. For businesses operating salons or service-based platforms relying on this booking plugin, compromise could lead to customer data theft (payment information, personal details), service disruption, regulatory penalties under data protection laws, and reputational damage. The ease of exploitation via social engineering means the threat is not theoretical—attackers need only deceive one administrator to gain full server access.

Affected systems

WordPress installations with the Salon Booking System – Free Version plugin version 10.30.32 and earlier are vulnerable. The plugin is publicly available in the WordPress plugin repository, making any site using it a potential target. No minimum WordPress version requirement is specified in the advisory, but vulnerability affects the plugin component directly. Sites where administrators are security-conscious and unlikely to click suspicious links face reduced—but not eliminated—risk.

Exploitability

Exploitability is high. The vulnerability requires no authentication and presents a low attack complexity; the attacker simply crafts a URL or HTML form that triggers the vulnerable function. The primary barrier is social engineering: convincing a site administrator to click a malicious link while logged in. Given the prevalence of phishing and credential compromise, this is a realistic threat. The attack is not dependent on any special network conditions (network is unchanged in impact); it works across any network boundary. Proof-of-concept construction is straightforward once nonce validation absence is confirmed.

Remediation

Immediate action: Update the Salon Booking System plugin to a patched version released after July 10, 2026. Check the vendor's release notes to verify the version fixes the CSRF and sanitization issues. Verify against the vendor advisory for the exact patched version number. Temporary mitigation (if an immediate patch is unavailable): Disable the plugin or restrict access to wp-admin via IP allowlist to reduce the window of social engineering success. Long-term: Enforce security best practices including regular plugin updates, removal of unused plugins, principle of least privilege for admin accounts, and security awareness training for administrators on phishing and malicious links.

Patch guidance

1. Log into your WordPress dashboard and navigate to Plugins > Installed Plugins. 2. Locate the Salon Booking System plugin and check the current version number. 3. If version is 10.30.32 or lower, update immediately by clicking 'Update Now' if available, or deactivate and uninstall the plugin pending a patch release. 4. After updating, verify the new version number matches the vendor's published fix (confirm against vendor release notes). 5. Test booking functionality on a staging environment before deploying to production. 6. Document the update in your change management system with the CVE number for audit purposes.

Detection guidance

Monitor for suspicious activity targeting wp-admin directories, especially requests to files related to the Salon Booking System plugin. Check server logs and WAF rules for POST requests to endpoints containing 'setCustomText' or attempts to write to translate-constants.php. Review recent changes to that file: unexpected PHP code, variable names with $, or syntax that doesn't match your booking system's normal operations may indicate exploitation. Examine WordPress user audit logs for admin actions that you did not authorize, particularly settings changes. If available, enable WordPress security plugins (e.g., Wordfence, Sucuri) that log POST request anomalies and file modifications. Conduct a code review of translate-constants.php for any injected PHP functions or suspicious includes.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (8.8), remote code execution impact, low attack complexity, and lack of authentication requirements. Although user interaction is required, social engineering is a proven attack vector. The prevalence of WordPress and plugin installations means the vulnerable user base is substantial. The absence of KEV status does not diminish urgency; it reflects current lack of public active exploitation tracking, not reduced risk. Organizations with salons, service businesses, or public-facing WordPress sites using this plugin should treat this as a critical patch deadline.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects: AV:N (network-accessible, no special positioning needed), AC:L (low attack complexity, standard CSRF + form submission), PR:N (no privileges required), UI:R (user interaction required, the social engineering component), S:U (scope unchanged), and C:H/I:H/A:H (confidentiality, integrity, and availability all highly impacted by remote code execution). The score appropriately penalizes the social engineering requirement but recognizes that code execution on a web server is a maximum-severity impact. High does not mean 'patch eventually'—it means 'prioritize within days, not weeks.'

Frequently asked questions