CVE-2026-110012 Salon Booking System CVE debrief

Who should care

Defenders responsible for WordPress plugin management and security should assess exposure and prioritize verification and remediation efforts. This includes administrators, security teams, and IT personnel managing WordPress installations with the Salon Booking System plugin. They should verify plugin versions, restrict access to booking REST API routes, and monitor for potential unauthorized access to customer booking records.

Why it matters

The Salon Booking System WordPress plugin vulnerability allows authenticated users to read customer booking records, potentially exposing personal data. Defenders should prioritize verifying exposure, restricting access, and monitoring for unauthorized access.

• Potential unauthorized access to customer booking records
• Possible exposure of personal data
• Verification of plugin version and access controls required
• Prioritization of remediation efforts

Technical summary

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data. This vulnerability enables attackers to access sensitive information without proper authorization, potentially leading to privacy breaches and unauthorized data access. Defenders should prioritize verifying exposure of the Salon Booking System WordPress plugin version and restricting access to booking REST API routes.

Defensive priority

Defenders should prioritize verifying exposure of the Salon Booking System WordPress plugin version and restricting access to booking REST API routes.

Recommended defensive actions

• Verify the version of the Salon Booking System WordPress plugin is 10.31.3 or later
• Restrict access to booking REST API routes to users with appropriate capabilities
• Monitor for potential unauthorized access to customer booking records
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The Salon Booking System plugin's REST API routes lack proper access controls, enabling unauthorized users to read customer booking records. This could lead to exposure of personal data, emphasizing the need for defenders to verify plugin versions and restrict access to these routes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.