{"id":"CVE-2026-110012","kind":"vulnerability","aliases":["CVE-2026-110012"],"related":[],"title":"Salon Booking System WordPress plugin: subscribers can read all customer bookings","description":"The Salon Booking System  WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.","summary":"The Salon Booking System WordPress plugin before 10.31.3 exposes several booking REST API routes without checking user capability. Any logged-in user, including a subscriber, can read every customer's booking records and their personal data.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","salon-booking-system","self-hosted","wordpress"],"not_affected_if":["no-user-registration","plugin-not-installed","plugin-version-10.31.3-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get salon-booking-system --field=version` (plugin slug assumed, unknown if different)\n- Review the plugin's REST routes for missing permission callbacks (unknown from the sources)","fix":"- Update the Salon Booking System plugin to `10.31.3` or later\n- Unknown whether any customer data should be reviewed or rotated after exposure","status":"open","published_at":"2026-10-16T07:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:14+00:00","updated_at":"2026-10-25T04:41:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Salon Booking System plugin to `10.31.3` or later\n- Unknown whether any customer data should be reviewed or rotated after exposure","reach":"internet","title":"Salon Booking System WordPress plugin: subscribers can read all customer bookings","impact":"medium","summary":"The Salon Booking System WordPress plugin before 10.31.3 exposes several booking REST API routes without checking user capability. Any logged-in user, including a subscriber, can read every customer's booking records and their personal data.","category":"package","nicknames":[],"who_cares":["wordpress","salon-booking-system","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Any logged-in user reads all customers' booking and personal data","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get salon-booking-system --field=version` (plugin slug assumed, unknown if different)\n- Review the plugin's REST routes for missing permission callbacks (unknown from the sources)","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-10.31.3-or-later","no-user-registration"],"who_is_affected":"WordPress sites running the Salon Booking System plugin before `10.31.3` are exposed, and any account that can log in, including a basic subscriber, can reach the booking data. Sites where registration is closed and no users can log in are much less exposed. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000612,"input_tokens":3302,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110012':14A,17A '-2026':13A,16A '10.31.3':34B,71C 'allow':88C 'api':39B,80C 'appropri':86C 'authent':90C 'book':2A,11A,21B,29B,37B,58B,66C,78C,101C 'capabl':44B,87C 'check':42B 'custom':10A,56B,99C 'cve':12A,15A 'data':63B,106C 'everi':55B,98C 'expos':35B 'host':25B 'includ':50B,103C 'log':47B 'logged-in':46B 'packag':18B 'person':62B,105C 'plugin':5A,32B,69C 'read':8A,54B,97C 'record':59B,102C 'rest':38B,79C 'restrict':74C 'rout':40B,81C 'salon':1A,20B,28B,65C 'salon-booking-system':19B 'self':24B 'self-host':23B 'sever':36B,75C 'subscrib':6A,52B,95C 'system':3A,22B,30B,67C 'user':43B,49B,83C,91C 'without':41B 'wordpress':4A,26B,31B,68C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Salon Booking System plugin before `10.31.3` are exposed, and any account that can log in, including a basic subscriber, can reach the booking data. Sites where registration is closed and no users can log in are much less exposed. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110012","severity":null,"published_at":"2026-10-16T07:17:10+00:00","modified_at":"2026-10-16T15:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}