CVE-2026-110035 Salon Booking System CVE debrief

Who should care

Defenders responsible for WordPress installations with the Salon Booking System plugin should assess exposure and prioritize verification and remediation. This includes reviewing the current version of the plugin, restricting access to the affected REST API endpoint, and monitoring for potential unauthorized access to discount coupons. Security teams and vulnerability management teams should also be aware of this vulnerability and take necessary actions to

Why it matters

The Salon Booking System WordPress plugin vulnerability allows any authenticated user to retrieve sensitive discount coupon information, potentially leading to unauthorized access and misuse.

• Potential unauthorized access to sensitive discount coupon information
• Possible misuse of discount coupons by unauthorized users
• Required verification of affected versions and potential impact
• Need for restricting access to the affected REST API endpoint

Technical summary

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits. This vulnerability allows unauthorized users to access sensitive information that could potentially be used for malicious purposes, such as unauthorized access or misuse of discount coupons.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and restrict access to the affected REST API endpoint.

Recommended defensive actions

• Verify the presence of the Salon Booking System WordPress plugin version before 10.31.11
• Restrict access to the affected REST API endpoint
• Monitor for potential unauthorized access to discount coupons
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The Salon Booking System plugin for WordPress, version before 10.31.11, has a known vulnerability that allows any authenticated user to retrieve every discount coupon configured on the site. This includes coupons that administrators have chosen to hide from customers, along with their amounts, validity dates, and usage limits. Defenders should verify the presence of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.