CVE-2026-15070

Name of the Vulnerable Software and Affected Versions Salon Booking System – Free Version versions prior to 10.30.33

Description This issue is a Cross-Site Request Forgery (CSRF) that allows unauthenticated attackers to achieve remote code execution on the server. The flaw exists due to missing or incorrect nonce validation in the setCustomText() function. An attacker can trick a site administrator into clicking a link to trigger a forged request, injecting arbitrary PHP code into the translate-constants.php file. Although the value parameter is processed by sanitize text field(), this function fails to neutralize characters such as single quotes, parentheses, semicolons, $, and [], allowing the attacker to break out of the PHP string literal before the data is written to disk using file put contents().

Recommendations Update the plugin to a version later than 10.30.32.