CVE-2026-110012: Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Salon Booking Systemto a version that resolves this vulnerability.Fixed in 10.31.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user, including a user with only the Subscriber role, can access the affected booking REST API routes. No elevated booking-management capability is required.
What information could be exposed?
An attacker can read booking records for every customer, including customers' personal data.
Which deployments are affected?
Salon Booking System WordPress plugin versions before 10.31.3 are affected. The issue involves insufficient capability checks on several booking REST API routes, including bookings/upcoming.