Live › vulnerability › CVE-2026-110035
Go to dashboardThe Salon Booking System WordPress plugin before 10.31.11 has a REST API endpoint without a staff-only check. Any logged-in user, including a basic subscriber, can read every discount coupon, including hidden ones, with amounts, validity dates and usage limits.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Salon Booking System plugin before 10.31.11 that also have user accounts with low-privilege roles such as subscriber, including accounts open to public registration. Sites without that plugin, or with it already on 10.31.11 or later, are not affected. The data exposed is limited to coupon configuration, so the risk is mainly to coupons meant to stay hidden.
No product ranges from the sources yet.
wp plugin get salon-booking-system --field=version10.31.11 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.
This page as .md · .json · in your agent: get_signal("CVE-2026-110035")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.