---
id: "CVE-2026-110012"
kind: "vulnerability"
aliases: ["CVE-2026-110012"]
title: "Salon Booking System WordPress plugin: subscribers can read all customer bookings"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "salon-booking-system", "self-hosted", "wordpress"]
not_affected_if: ["no-user-registration", "plugin-not-installed", "plugin-version-10.31.3-or-later"]
published_at: "2026-10-16T07:17:10+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110012", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Salon Booking System WordPress plugin: subscribers can read all customer bookings

The Salon Booking System WordPress plugin before 10.31.3 exposes several booking REST API routes without checking user capability. Any logged-in user, including a subscriber, can read every customer's booking records and their personal data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get salon-booking-system --field=version` (plugin slug assumed, unknown if different)
- Review the plugin's REST routes for missing permission callbacks (unknown from the sources)

## Fix

- Update the Salon Booking System plugin to `10.31.3` or later
- Unknown whether any customer data should be reviewed or rotated after exposure

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110012

## From the sources

The Salon Booking System  WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_