CVE-2026-110013
Received Received - Intake

Insecure Token Generation in Salon Booking System WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110013
EUVD
EUVD-2026-102692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Salon Booking System 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Salon Booking System WordPress plugin before version 10.31.9 generates access tokens for its booking API in an insecure way. Instead of using a secure random source, tokens are derived from a hardcoded value combined with the exact second the token was issued. This predictability allows attackers to compute valid tokens if they know when a token was created.

Detection Guidance

Check if your Salon Booking System plugin version is below 10.31.9. Inspect API token generation logs for predictable patterns combining hardcoded values and timestamps. Monitor unauthorized API access attempts or unusual administrative actions.

Impact Analysis

An attacker could gain unauthorized access to the Salon Booking System API, potentially including administrative functions. This could allow them to view, modify, or delete bookings, access sensitive data, or perform actions as a privileged user without proper authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using the affected plugin may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.9 or later immediately. Review and revoke any potentially compromised API tokens. Implement additional authentication measures for API access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart