CVE-2026-110012

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-10-16

Last modified

2026-10-16

Weaknesses

CWE-200

Affected products

• Salon Booking System (Unknown)

References

• https://wpscan.com/vulnerability/7253eae4-4759-4388-8120-500b9d7352c4/