CVE-2026-110013: Salon Booking System Auth Bypass Vulnerability

CVE-2026-110013 Overview

CVE-2026-110013 is an authentication weakness [CWE-287] in the Salon Booking System WordPress plugin versions before 10.31.9. The plugin generates booking-API access tokens using a predictable algorithm rather than a cryptographically secure random source. Tokens are derived from a hardcoded value within the plugin combined with the second at which the token was issued. An attacker who can constrain the issuance time of a staff or administrator token can compute a valid token offline. The attacker then uses that token to access the booking API as the impersonated user, including an administrator account.

Critical Impact

Predictable token generation allows attackers to forge valid API tokens and access booking-API endpoints as staff or administrators without credentials.

Affected Products

• Salon Booking System WordPress plugin versions prior to 10.31.9

Discovery Timeline

• 2026-10-16 - CVE-2026-110013 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110013

Vulnerability Analysis

The Salon Booking System plugin issues access tokens that authenticate requests to its booking API. Instead of pulling entropy from a cryptographically secure pseudo-random number generator, the plugin derives each token deterministically. Two inputs feed the derivation: a static value hardcoded in the plugin source and the Unix second at which the token was generated.

Because both inputs have low entropy, the token space collapses. An attacker who learns or guesses the second a token was issued can regenerate every candidate token for that window. The hardcoded secret is identical across every installation of the vulnerable plugin version, so it only needs to be recovered once.

Root Cause

The root cause is insecure randomness combined with hardcoded credentials in the token-generation routine. Secure design requires tokens to be drawn from a cryptographic RNG with sufficient entropy, such as random_bytes() in PHP. The plugin instead uses a time-seeded derivation around a static constant, violating fundamental authentication token requirements.

Attack Vector

Exploitation is remote and unauthenticated but requires attack conditions to align. The attacker first obtains the hardcoded value by reading the publicly available plugin source. Next, the attacker must constrain the second during which a target staff or administrator token was issued. Timing can be inferred from observable events such as a scheduled staff login, a booking confirmation email, or triggered administrative actions.

Once the issuance second is narrowed to a short window, the attacker iterates through each candidate second, applies the deterministic derivation, and produces a set of valid tokens. Submitting any matching token to the booking API grants access with the privileges of the impersonated user. See the WPScan Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-110013

Indicators of Compromise

• Unexpected successful booking-API requests from unfamiliar IP addresses carrying tokens tied to staff or administrator accounts.
• Booking records, availability changes, or customer data exports made outside of normal operating hours or without a corresponding admin console session.
• Repeated API calls iterating through similar-looking token values, indicative of brute-force token guessing against the issuance window.

Detection Strategies

• Inspect WordPress and web server logs for booking-API endpoint access patterns that do not correspond to a legitimate admin or staff login event.
• Correlate token-authenticated API calls with authentication events to flag requests whose tokens have no matching issuance in the admin UI.
• Alert on bursts of 4xx responses to booking-API endpoints followed by a 200 response, consistent with token enumeration leading to a successful hit.

Monitoring Recommendations

• Enable verbose request logging on the booking-API routes and forward logs to a centralized SIEM for retention and query.
• Monitor plugin version strings across managed WordPress sites to confirm the patched release is in place.
• Review user and role audit trails for unauthorized changes to administrator accounts, roles, or booking settings.

How to Mitigate CVE-2026-110013

Immediate Actions Required

• Upgrade the Salon Booking System plugin to version 10.31.9 or later on every WordPress installation.
• Invalidate all existing booking-API tokens after upgrade so that any token forged under the vulnerable scheme is rejected.
• Audit administrator and staff accounts for unauthorized modifications, new bookings, or data exports made since the plugin was installed.

Patch Information

The vendor addressed the issue in Salon Booking System plugin version 10.31.9. The fix replaces the time-seeded, hardcoded derivation with tokens generated from a cryptographically secure random source. Refer to the WPScan Vulnerability Advisory for the authoritative advisory.

Workarounds

• If immediate patching is not possible, deactivate the Salon Booking System plugin until the upgrade can be applied.
• Restrict access to the WordPress site and booking-API endpoints to known IP ranges using a web application firewall or server-level ACL.
• Rotate administrator passwords and force reauthentication for staff accounts to limit the usefulness of any previously computed tokens.

# Configuration example: restrict booking-API endpoints via nginx until patched
location ~ ^/wp-json/salon-booking-system/ {
    allow 203.0.113.0/24;   # trusted office network
    deny  all;
}