CVE-2026-110013 in Salon Booking System Plugin
Summary
by MITRE • 10/16/2026
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The Salon Booking System WordPress plugin prior to version 10.31.9 contains a critical authentication bypass vulnerability stemming from weak cryptographic random number generation for session tokens. Specifically, the mechanism used to generate booking-API access tokens fails to utilize a cryptographically secure pseudo-random number generator as required by modern security standards. Instead, the token derivation process relies on predictable inputs, primarily incorporating values that are either hardcoded within the plugin code or derived from the timestamp of when the token was issued. This design flaw fundamentally undermines the integrity and unpredictability expected in authentication mechanisms, allowing an attacker to reverse-engineer valid tokens if they possess sufficient contextual information regarding their generation.
From a technical perspective, this vulnerability aligns with CWE-330: Use of Insufficiently Random Values. The security model assumes that access tokens are unique and unpredictable secrets known only to the authenticated user and the server. However, by basing token creation on static hardcoded values or predictable temporal data such as issuance timestamps, the system creates a deterministic relationship between these inputs and the resulting token output. If an attacker can constrain or observe when a staff member or administrator requests a new token, they can replicate the algorithmic process used to generate that specific token. This effectively neutralizes the security boundary provided by the authentication layer, transforming what should be a secret key into a computable value based on public or easily observable parameters.
The operational impact of this flaw is severe, particularly given the administrative privileges often associated with booking system tokens in WordPress environments. An attacker who successfully computes a valid token can impersonate any user whose token issuance time they have constrained or observed. This includes high-privilege accounts such as administrators, granting the attacker full access to the booking API. Through this unauthorized access, an adversary could manipulate appointment schedules, view sensitive customer data including names and contact information, delete bookings, or potentially escalate privileges further depending on how the backend processes these API requests. The ability to act as an administrator means that not only is confidentiality compromised, but also integrity and availability of the booking system are at risk.
This vulnerability maps directly to MITRE ATT&CK technique T1078: Valid Accounts, specifically within the context of local accounts on a web application platform like WordPress. By forging valid authentication credentials through algorithmic prediction rather than brute force or credential theft, the attacker bypasses standard login controls. The exploitation path typically involves identifying when an administrative token is generated, often by monitoring network traffic or exploiting other low-severity flaws that reveal timing information, and then applying the known weak generation logic to produce a matching token for session hijacking or direct API abuse.
To mitigate this vulnerability, immediate action must be taken to upgrade the Salon Booking System plugin to version 10.31.9 or later, where the developers have addressed the random number generation flaw by implementing cryptographically secure methods such as using operating system-level entropy sources like /dev/urandom on Linux systems or CryptGenRandom on Windows environments. Until an update is applied, site administrators should consider restricting access to the booking API endpoints via web application firewall rules if possible, and enforcing strict rate limiting to make it more difficult for attackers to observe token issuance patterns without detection. Additionally, implementing additional layers of authentication such as two-factor authentication can provide a compensating control that does not rely solely on the strength of session tokens alone. Regular security audits focusing on cryptographic implementation details are recommended to prevent similar issues in other plugins or custom code within the WordPress ecosystem.