CVE-2026-110012: Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

Q: Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can access the affected booking REST API routes. No elevated booking-management capability is required.

Q: What information could be exposed?

An attacker can read booking records for every customer, including customers' personal data.

Q: Which deployments are affected?

Salon Booking System WordPress plugin versions before 10.31.3 are affected. The issue involves insufficient capability checks on several booking REST API routes, including bookings/upcoming.

Published Oct 16, 2026

Updated

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

Affected Software

1 affected component

Salon Booking System Salon Booking System WordPress plugin<10.31.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Salon Booking System to a version that resolves this vulnerability.
Fixed in 10.31.3

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can access the affected booking REST API routes. No elevated booking-management capability is required.

What information could be exposed?

An attacker can read booking records for every customer, including customers' personal data.

Which deployments are affected?

Salon Booking System WordPress plugin versions before 10.31.3 are affected. The issue involves insufficient capability checks on several booking REST API routes, including bookings/upcoming.

CVE-2026-110012: Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which deployments are affected?