CVE-2026-110012
Received Received - Intake

Unauthenticated Access to Customer Data in Salon Booking System WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110012
EUVD
EUVD-2026-102691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Salon Booking System 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Salon Booking System WordPress plugin before version 10.31.3 has a vulnerability where it does not restrict access to booking-related REST API routes. This allows any authenticated user, including subscribers, to read all customer booking records and personal data without proper authorization.

Detection Guidance

Check if the Salon Booking System plugin version is below 10.31.3. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the installed version.

Impact Analysis

This vulnerability allows unauthorized users to access and disclose personally identifiable information (PII) of other customers, including sensitive booking records. It poses a risk of data breaches and privacy violations for both customers and the business using the plugin.

Compliance Impact

This vulnerability can lead to non-compliance with data protection regulations like GDPR and HIPAA, as it allows unauthorized access to personal data. Businesses may face legal penalties, fines, and reputational damage due to data breaches resulting from this issue.

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.3 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart