Live › vulnerability › CVE-2026-110013
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.9 derives its booking-API access tokens from a hardcoded value and the issue time instead of a secure random source. An attacker who can work out when a staff or administrator token was issued can compute a valid token and act on the booking API as that user, including an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System WordPress plugin before 10.31.9 that expose its booking API are affected. Sites without the plugin, or running 10.31.9 or later, can skip this.
No product ranges from the sources yet.
wp plugin get salon-booking-system --field=version with WP-CLI, and confirm it is 10.31.9 or later.10.31.9 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-110013")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.