4.3
Medium
CVE-2026-110035 The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon…
Description
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Salon booking system 10.31 | earliest → < 10.31.11 | 10.31.11 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Salon booking system
The 21 CVEs of Salon booking system →
CVE-2026-110034
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a…
3.7
Low
CVE-2026-110032
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles…
5.5
Medium
CVE-2026-110033
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching…
6.8
Medium
CVE-2026-110031
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role…
7.2
High