CVE-2026-110034: Salon Booking System Auth Bypass Flaw

CVE-2026-110034 Overview

CVE-2026-110034 affects the Salon Booking System WordPress plugin in versions before 10.31.11. The plugin fails to enforce a minimum value of zero when subtracting a fixed-amount discount from a booking total. An unauthenticated visitor who knows a valid discount code can submit a booking that results in a negative total. The plugin stores the booking as confirmed with that negative value. The flaw is classified under CWE-20: Improper Input Validation.

Critical Impact

Unauthenticated attackers aware of a valid discount code can create confirmed bookings with negative totals, corrupting financial records and booking integrity.

Affected Products

• Salon Booking System WordPress plugin versions prior to 10.31.11

Discovery Timeline

• 2026-10-19 - CVE-2026-110034 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110034

Vulnerability Analysis

The Salon Booking System plugin processes discount codes during the booking checkout flow. When a fixed-amount discount is applied, the plugin subtracts the discount value from the booking subtotal without clamping the result to zero. If the discount exceeds the subtotal, the stored total becomes negative. The booking is persisted and marked as confirmed without additional validation.

Because the endpoint accepts unauthenticated requests, any visitor who possesses a valid discount code can trigger the condition. The impact is bounded to integrity of booking records and financial reporting. Confidentiality and availability are not directly affected. The attack complexity is elevated because the attacker must first obtain a valid discount code, which is not always publicly distributed.

Root Cause

The root cause is a missing lower-bound check on the computed booking total after discount subtraction. The plugin trusts the arithmetic result of subtotal - fixed_discount without applying max(0, result) or rejecting discounts that exceed the subtotal. This is a classic input validation failure mapped to [CWE-20].

Attack Vector

The attack is executed over the network against the plugin's public booking endpoint. The attacker submits a booking request with a service whose price is lower than the fixed value of a known discount code. The server-side logic calculates a negative total, writes the booking record, and returns a confirmation. No authentication, user interaction, or elevated privileges are required beyond knowledge of the code. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-110034

Indicators of Compromise

• Booking records in the plugin's database tables containing negative values in the total or amount columns.
• Unexpected confirmed bookings tied to low-priced services combined with fixed-amount discount codes.
• Spikes in booking submissions from unauthenticated sessions referencing the same discount code.

Detection Strategies

• Query the Salon Booking System tables for any booking row where total < 0 and alert on matches.
• Review web server access logs for repeated POST requests to the plugin's booking submission endpoint carrying discount code parameters.
• Correlate booking creation events with the discount codes used and flag anomalies where discount value exceeds service price.

Monitoring Recommendations

• Enable application-level logging for the booking creation workflow, capturing subtotal, discount applied, and final total.
• Monitor financial reconciliation jobs for sudden drops in gross revenue tied to the plugin.
• Alert on new booking confirmations originating from IPs with no prior session history.

How to Mitigate CVE-2026-110034

Immediate Actions Required

• Upgrade the Salon Booking System plugin to version 10.31.11 or later on all WordPress sites.
• Audit existing booking records for negative totals and reconcile any affected transactions.
• Rotate or invalidate any fixed-amount discount codes suspected of exposure.

Patch Information

The vendor addressed the issue in Salon Booking System version 10.31.11. The fix enforces a zero-minimum when applying fixed-amount discounts to booking totals. Refer to the WPScan Vulnerability Report for release details.

Workarounds

• Temporarily disable fixed-amount discount codes and use percentage-based discounts, which cannot produce negative totals.
• Restrict access to the booking endpoint through a web application firewall rule that rejects requests where the computed total would be negative.
• Limit distribution of discount codes and shorten their validity windows until the patch is deployed.

# Configuration example: WP-CLI plugin update
wp plugin update salon-booking-system --version=10.31.11