Negative Total Discount in Salon Booking System WordPress Plugin

Executive Summary

The Salon Booking System WordPress plugin before version 10.31.11 has a flaw where it does not set a minimum value of zero when applying a fixed-amount discount to a booking's total. This allows an unauthenticated visitor with knowledge of a valid discount code to create a booking that is confirmed but stored with a negative total amount.

Useful 0 Not Useful 0

Detection Guidance

Check if the Salon Booking System WordPress plugin version is below 10.31.11. Inspect booking totals for negative values which indicate exploitation. Review discount code logic for improper validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to create bookings with negative totals, potentially leading to financial losses or fraudulent transactions. It may also disrupt normal booking operations and cause confusion in financial records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a technical flaw in discount calculation for bookings rather than data privacy or security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.11 or later. Disable any discount codes temporarily until patched. Monitor bookings for negative totals as a sign of exploitation.

Useful 0 Not Useful 0