CVE-2026-15070: Salon Booking System - Remote code execution

CVE-2026-15070 is a high severity vulnerability (CVSS 8.8) identified in the National Vulnerability Database. The Salon Booking System - Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inject

TL;DR: This is a remote code execution vulnerability (CVSS 8.8 HIGH). Authentication: Not required (unauthenticated). Patch immediately.

The Salon Booking System - Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into the web-accessible translate-constants.php file within the plugin directory, enabling remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. sanitize_text_field() is applied to the POST 'value' parameter but does not neutralize the characters - single quotes, parentheses, semicolons, $, and [] - required to break out of the PHP string literal into which the value is interpolated before being written to disk via file_put_contents().

The National Vulnerability Database assigned this issue a CVSS base score of 8.8 , placing it in the HIGH category. The identifier CVE-2026-15070 was published on 2026-07-10T04:17:47.727.

Based on the vulnerability data published by NVD, the following products and configurations are identified as affected:

If your organization uses any of the above, this vulnerability applies to your environment. Even if your specific version is not listed, review the full CPE match data to confirm.

Illustrative patterns for defensive detection. Not a working exploit.

CSRF attacks trick authenticated users into submitting state-changing requests. Watch for:

Here is what we recommend, in order of priority:

Run as administrator. Collect artifacts before applying patches or making changes:

If you need help analyzing these artifacts, call Sherlock Forensics at 604.229.1994 .

A CVSS score of 8.8 means this vulnerability is straightforward to exploit, likely to cause significant damage or both. For startups and small companies operating without a dedicated security team, vulnerabilities at this severity level represent real operational risk rather than theoretical concern.

The challenge is not awareness. Vulnerability databases are public. The challenge is triage: understanding whether a given CVE affects your specific stack and knowing what to do it before an attacker does. If you lack the internal capacity to perform that assessment, an external review of your exposure is a concrete step.

Sherlock Forensics provides vulnerability assessment and penetration testing for organizations that need to understand their attack surface without building a full internal security function.