{"id":"CVE-2026-110035","kind":"vulnerability","aliases":["CVE-2026-110035"],"related":[],"title":"Salon Booking System WordPress plugin exposes hidden discount coupons to subscribers","description":"The Salon Booking System  WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.","summary":"The Salon Booking System WordPress plugin before 10.31.11 has a REST API endpoint without a staff-only check. Any logged-in user, including a basic subscriber, can read every discount coupon, including hidden ones, with amounts, validity dates and usage limits.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","salon-booking-system","self-hosted","wordpress"],"not_affected_if":["no-user-registration","plugin-updated-10.31.11"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins page or with `wp plugin get salon-booking-system --field=version`\n- Confirm whether the site allows customer or subscriber accounts that anyone can register","fix":"- Update the Salon Booking System plugin to `10.31.11` or later\n- Review coupon values for anything sensitive that should not be visible to customers","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:39:49+00:00","updated_at":"2026-10-25T04:39:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:39:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Salon Booking System plugin to `10.31.11` or later\n- Review coupon values for anything sensitive that should not be visible to customers","reach":"internet","title":"Salon Booking System WordPress plugin exposes hidden discount coupons to subscribers","impact":"low","summary":"The Salon Booking System WordPress plugin before 10.31.11 has a REST API endpoint without a staff-only check. Any logged-in user, including a basic subscriber, can read every discount coupon, including hidden ones, with amounts, validity dates and usage limits.","category":"package","nicknames":[],"who_cares":["wordpress","salon-booking-system","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Any logged-in user reads hidden coupons and their validity and limits","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins page or with `wp plugin get salon-booking-system --field=version`\n- Confirm whether the site allows customer or subscriber accounts that anyone can register","needs_analyst":false,"not_affected_if":["plugin-updated-10.31.11","no-user-registration"],"who_is_affected":"Sites running the Salon Booking System plugin before 10.31.11 that also have user accounts with low-privilege roles such as subscriber, including accounts open to public registration. Sites without that plugin, or with it already on 10.31.11 or later, are not affected. The data exposed is limited to coupon configuration, so the risk is mainly to coupons meant to stay hidden.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3338,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110035':14A,17A '-2026':13A,16A '10.31.11':34B,77C 'administr':110C 'allow':90C 'amount':64B,120C 'api':38B,85C 'authent':92C 'basic':53B 'book':2A,21B,29B,72C 'check':45B 'chosen':112C 'configur':103C 'coupon':9A,59B,102C,108C 'custom':116C 'cve':12A,15A 'date':66B,122C 'discount':8A,58B,101C 'endpoint':39B,86C 'everi':57B,100C 'expos':6A 'hidden':7A,61B 'hide':114C 'host':25B 'includ':51B,60B,107C 'limit':69B,125C 'log':48B 'logged-in':47B 'one':62B,81C 'packag':18B 'plugin':5A,32B,75C 'read':56B 'rest':37B,84C 'restrict':80C 'retriev':99C 'salon':1A,20B,28B,71C,88C 'salon-booking-system':19B 'self':24B 'self-host':23B 'site':106C 'staff':43B,89C 'staff-on':42B 'subscrib':11A,54B,97C 'system':3A,22B,30B,73C 'togeth':117C 'usag':68B,124C 'user':50B,93C 'valid':65B,121C 'without':40B 'wordpress':4A,26B,31B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Salon Booking System plugin before 10.31.11 that also have user accounts with low-privilege roles such as subscriber, including accounts open to public registration. Sites without that plugin, or with it already on 10.31.11 or later, are not affected. The data exposed is limited to coupon configuration, so the risk is mainly to coupons meant to stay hidden.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110035","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}