CVE-2026-110013: Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Salon Booking System versions before 10.31.9 are affected. The issue concerns booking-API access tokens issued to staff or administrator users.
What does an attacker need to exploit this?
The attacker must be able to constrain the time at which a staff or administrator token was issued. They can then compute a valid token because token generation uses a hardcoded value and the issuance second rather than a secure random source.
What level of access could exploitation provide?
A computed token can let the attacker access the booking API as the user whose token was issued, including as an administrator.