CVE-2026-110035
Received Received - Intake

Unauthorized Discount Coupon Access in Salon Booking System

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: WPScan

Description
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-110035
EUVD
EUVD-2026-103395

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Salon Booking System 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Salon Booking System WordPress plugin before version 10.31.11 has a vulnerability where an improperly restricted REST API endpoint allows any authenticated user, including subscribers, to access all discount coupons configured on the site. This includes hidden coupons with their amounts, validity dates, and usage limits.

Detection Guidance

Check WordPress plugin versions using WP-CLI with 'wp plugin list' and compare against version 10.31.11. Inspect network traffic for unauthorized REST API calls to '/wp-json/salon/v1/discounts' from non-staff users.

Impact Analysis

This vulnerability exposes sensitive coupon details to unauthorized users, potentially allowing attackers to gain insights into pricing strategies, discounts, and promotional plans. It may also lead to misuse of coupons or financial losses if hidden discounts are exploited.

Compliance Impact

This vulnerability could potentially violate GDPR and HIPAA by exposing sensitive coupon details, including amounts and validity dates, to unauthorized users. Unauthorized access to such data may lead to breaches of confidentiality requirements under these regulations.

Mitigation Strategies

Update the Salon Booking System plugin to version 10.31.11 or later immediately. Review user roles and permissions to ensure only authorized staff can access coupon data. Monitor for suspicious API requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart