Live › vulnerability › CVE-2026-110034
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.11 does not stop a fixed-amount discount from pushing a booking's total below zero. An unauthenticated visitor who knows a valid discount code can create a confirmed booking stored with a negative total.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System WordPress plugin before 10.31.11 that accept online bookings and have fixed-amount discount codes. The flaw affects the booking total calculation, so the impact is on pricing and payment records rather than server access. Sites without the plugin or without fixed-amount discount codes can skip it.
No product ranges from the sources yet.
wp-content/plugins/salon-booking-system/; versions below 10.31.11 are affected.10.31.11 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
This page as .md · .json · in your agent: get_signal("CVE-2026-110034")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.