Live › vulnerability › CVE-2026-110012
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.3 exposes several booking REST API routes without checking user capability. Any logged-in user, including a subscriber, can read every customer's booking records and their personal data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running the Salon Booking System plugin before 10.31.3 are exposed, and any account that can log in, including a basic subscriber, can reach the booking data. Sites where registration is closed and no users can log in are much less exposed. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get salon-booking-system --field=version (plugin slug assumed, unknown if different)10.31.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
This page as .md · .json · in your agent: get_signal("CVE-2026-110012")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.