CVE-2026-110034: Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Salon Booking Systemto a version that resolves this vulnerability.Fixed in 10.31.11
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it if they know a valid fixed-amount discount code whose value exceeds the booking total. No account or user interaction is required.
Which installations are affected?
Salon Booking System WordPress plugin versions earlier than 10.31.11 are affected. The issue applies where a valid discount code can be used during booking.
What is the impact of successful exploitation?
An attacker can create a confirmed booking that is stored with a negative total. The provided information identifies integrity impact only; it does not state that confidentiality or availability is affected.