CVE-2026-110012 in Salon Booking System Plugin
Summary
by MITRE • 10/16/2026
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the Salon Booking System WordPress plugin prior to version 10.31.3 represents a critical failure in access control mechanisms within the application’s REST API implementation. This flaw stems from an improper restriction of endpoint permissions, specifically affecting several booking-related routes that were intended to be accessible only by users with elevated privileges or specific administrative capabilities. Instead of enforcing strict role-based access controls, the plugin allows any authenticated user, including those with the lowest privilege level such as subscribers, to interact with these endpoints without sufficient verification of their authorization rights. This misconfiguration effectively bypasses the security boundaries designed to protect sensitive business data and customer information within the WordPress ecosystem.
From a technical perspective, this issue is classified under CWE-284, which denotes Improper Access Control, specifically involving insufficient restrictions on access to API resources. The vulnerability allows for unauthorized data retrieval because the server-side logic fails to validate whether the authenticated user possesses the necessary capabilities before processing requests aimed at fetching booking records. In a typical WordPress environment, REST API endpoints should check for specific permissions such as edit_posts or manage_options depending on the sensitivity of the data being accessed. By neglecting this validation step, the plugin exposes internal business operations and personal customer details to any logged-in user on the site. This aligns with MITRE ATT&CK technique T1078, Valid Accounts, where an attacker leverages legitimate credentials to gain unauthorized access to system resources that are not intended for their role or clearance level.
The operational impact of this vulnerability is significant due to the nature of the data exposed. Salon Booking Systems typically handle sensitive personal information including names, contact details, appointment times, and potentially payment history associated with customer bookings. The ability for a subscriber-level user to read every customer's booking records constitutes a severe privacy breach. This exposure can lead to unauthorized surveillance of competitors' client bases if multiple salons use the same platform or site structure, but more critically it violates data protection regulations such as GDPR or CCPA by allowing non-authorized personnel to access personally identifiable information. The confidentiality and integrity of customer relationships are compromised, potentially leading to reputational damage for the business owners using the plugin and legal liabilities arising from privacy violations.
To mitigate this vulnerability, immediate action is required to update the Salon Booking System WordPress plugin to version 10.31.3 or later where these access control issues have been addressed by the developers. Until an upgrade can be performed, administrators should consider implementing additional security layers such as Web Application Firewalls that can monitor and restrict API traffic based on user roles. It is also advisable to review other custom REST endpoints within the WordPress installation to ensure they adhere to strict permission checks using standard functions like current_user_can or rest_authorization_check. Regular audits of plugin code for proper capability verification in all public-facing APIs are essential to prevent similar access control failures that could lead to data exfiltration and privacy breaches.