CVE-2026-110012: Salon Booking System Information Disclosure

CVE-2026-110012 Overview

CVE-2026-110012 affects the Salon Booking System WordPress plugin in versions prior to 10.31.3. The plugin exposes several booking REST API routes without enforcing capability checks on the caller. Any authenticated user, including low-privilege subscribers, can query these routes and retrieve every customer's booking records. The exposed data includes personal information attached to appointments. The flaw is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Authenticated users at the subscriber level can read all customer booking records, exposing personal data stored by the plugin.

Affected Products

Salon Booking System WordPress plugin versions before 10.31.3
WordPress sites allowing subscriber-level registration with the plugin installed
Any site exposing the vulnerable REST API routes to authenticated users

Discovery Timeline

2026-10-16 - CVE-2026-110012 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110012

Vulnerability Analysis

The Salon Booking System plugin registers REST API routes that return customer booking data. The route handlers do not verify that the caller holds the capability required to access that data. WordPress authenticates the request and passes it to the plugin, which then returns records belonging to any customer. A subscriber account, which normally has no access to booking administration, can enumerate full booking histories including personally identifiable information (PII).

The weakness fits the broader pattern of broken access control in REST endpoints, where authentication is validated but authorization is skipped. Exploitation requires only valid credentials on the target WordPress site and the ability to issue authenticated HTTP requests.

Root Cause

The plugin's REST route registration omits a proper permission_callback that restricts access to users with a booking-management capability. Instead, the callback either returns true or checks only that the user is logged in. Because WordPress treats a missing or permissive permission_callback as public to any authenticated session, every booking record becomes readable by any registered user.

Attack Vector

An attacker registers or compromises a subscriber account on a WordPress site running a vulnerable version of the plugin. The attacker then issues authenticated HTTP GET requests to the affected booking REST endpoints under /wp-json/. The server responds with JSON documents containing customer identifiers, contact details, and booking metadata. No further privilege escalation or administrative access is required to harvest the data at scale.

See the WPScan Vulnerability Report for route-level details.

Detection Methods for CVE-2026-110012

Indicators of Compromise

Repeated authenticated requests from a single low-privilege user to /wp-json/ routes exposed by the Salon Booking System plugin.
Unusual volume of JSON responses containing customer booking fields served to non-administrator sessions.
Subscriber accounts enumerating sequential booking IDs or paginating through booking collections.

Detection Strategies

Review WordPress access logs for REST API calls to Salon Booking System routes originating from users whose roles do not include booking management.
Correlate authenticated session IDs with the roles and capabilities assigned to the underlying user account.
Alert on response payloads from booking endpoints that exceed expected size thresholds for ordinary customer self-service requests.

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a central SIEM for behavioral analysis.
Track newly created subscriber accounts that begin issuing REST API calls shortly after registration.
Monitor outbound data volumes from the web server to detect bulk extraction of booking records.

How to Mitigate CVE-2026-110012

Immediate Actions Required

Upgrade the Salon Booking System plugin to version 10.31.3 or later on all WordPress installations.
Audit existing subscriber and customer accounts and remove any that are unexpected or inactive.
Review web server and WordPress logs for prior access to the affected REST endpoints by non-privileged users.

Patch Information

The vendor fixed the issue in Salon Booking System version 10.31.3 by enforcing capability checks on the affected REST API routes. Refer to the WPScan Vulnerability Report for the advisory record and fixed-version confirmation.

Workarounds

Disable user registration on sites that do not require customer self-service accounts until the plugin is updated.
Restrict access to /wp-json/ routes exposed by the plugin using a web application firewall rule that validates the caller's role.
Temporarily deactivate the Salon Booking System plugin if an immediate upgrade is not possible.

bash

# Example WP-CLI commands to update the plugin and audit subscribers
wp plugin update salon-booking-system --version=10.31.3
wp user list --role=subscriber --fields=ID,user_login,user_registered,user_email