WordPress Salon Booking Plugin Privilege Escalation Flaw

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Salon Booking System WordPress plugin before version 10.31.11 contains a critical privilege escalation vulnerability that allows users with the custom 'salon staff' role to arbitrarily assign capabilities to other user accounts during customer editing operations. This flaw bypasses WordPress's built-in permission checks, enabling attackers to promote any account—including their own—to administrator status and gain complete control over the WordPress installation. Any WordPress site running this plugin with salon staff users represents an attack surface, particularly in multi-tenant salon management environments where staff accounts are common and may be shared or compromised.

Casky's 224 mapped skills detect the attack patterns underlying this vulnerability through analysis of MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky's platform would identify suspicious findings around unauthorized capability assignments, role modification API calls, and account permission changes initiated by lower-privileged users. Claude's extended reasoning capabilities correlate the plugin's customer editing workflows with WordPress capability injection patterns, flagging instances where salon staff roles trigger unexpected admin capability grants. Security teams would observe evidence of horizontal privilege escalation attempts—staff users modifying peer or administrative accounts—combined with backend database changes showing capability bits being set outside normal administrative channels, enabling rapid detection and containment before site takeover occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110031.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-110031

Casky has 224 skills that investigate the attack patterns behind CVE-2026-110031. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn