CVE-2026-110034 Salon Booking System CVE debrief

Who should care

Defenders responsible for WordPress installations using the Salon Booking System plugin should assess exposure and prioritize verification and potential updates to prevent abuse of discount codes.

Why it matters

Defenders should care about CVE-2026-110034 because it allows unauthenticated visitors to create bookings with negative totals using valid discount codes, potentially leading to financial and reputational impacts. WordPress administrators and security teams should verify plugin versions and apply updates to prevent discount code abuse.

• Potential financial impact through abuse of discount codes
• Reputation damage from bookings with negative totals
• Increased monitoring and incident response requirements
• Potential data integrity issues if bookings with negative totals are not properly handled

Technical summary

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total. This vulnerability can lead to financial and reputational impacts. The vulnerability is caused by the lack of input validation and sanitization in the plugin's discount code functionality. Defenders should prioritize verifying the version of the Salon Booking System WordPress plugin and applying the necessary updates to prevent potential abuse of discount codes.

Defensive priority

Defenders should prioritize verifying the version of the Salon Booking System WordPress plugin and applying the necessary updates to prevent potential abuse of discount codes.

Recommended defensive actions

• Verify the version of the Salon Booking System WordPress plugin and apply updates if necessary.
• Restrict access to discount code usage to authenticated users or those with a legitimate need.
• Monitor for and respond to potential abuse of discount codes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the WPScan source reference. The WPScan source reference provides additional vulnerability details. However, the details are limited, and defenders should verify the plugin version and apply updates if necessary. The vulnerability allows unauthenticated visitors to create bookings with negative totals using valid discount codes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.