CVE-2026-110035: Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route

Q: Who can exploit this issue?

Any authenticated WordPress user can access the affected REST endpoint. This includes low-privilege accounts such as subscribers; salon staff access is not required.

Q: What information can be exposed?

An attacker can retrieve every configured discount coupon, including coupons hidden from customers. The exposed data includes coupon amounts, validity dates, and usage limits.

Q: Are sites affected if they use hidden or non-public coupons?

Yes. The issue specifically exposes coupons that an administrator has chosen to hide from customers, as long as an authenticated user can access the vulnerable endpoint.

Q: Which plugin versions are affected?

Salon Booking System versions before 10.31.11 are affected. Updating to version 10.31.11 or later addresses the affected version range.

Published Oct 18, 2026

Updated

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.

Affected Software

1 affected component

Salon Booking System Salon Booking System WordPress plugin<10.31.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Salon Booking System to a version that resolves this vulnerability.
Fixed in 10.31.11

Event History

Oct 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can access the affected REST endpoint. This includes low-privilege accounts such as subscribers; salon staff access is not required.

What information can be exposed?

An attacker can retrieve every configured discount coupon, including coupons hidden from customers. The exposed data includes coupon amounts, validity dates, and usage limits.

Are sites affected if they use hidden or non-public coupons?

Yes. The issue specifically exposes coupons that an administrator has chosen to hide from customers, as long as an authenticated user can access the vulnerable endpoint.

Which plugin versions are affected?

Salon Booking System versions before 10.31.11 are affected. Updating to version 10.31.11 or later addresses the affected version range.

CVE-2026-110035: Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are sites affected if they use hidden or non-public coupons?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are sites affected if they use hidden or non-public coupons?

Which plugin versions are affected?