CVE-2026-110035: Salon Booking System Information Disclosure

CVE-2026-110035 Overview

CVE-2026-110035 is a broken access control vulnerability [CWE-284] in the Salon Booking System WordPress plugin before version 10.31.11. The plugin fails to restrict a REST API endpoint to salon staff, allowing any authenticated user — including low-privilege subscribers — to enumerate every discount coupon configured on the site. Exposed data includes coupon codes hidden from customers, discount amounts, validity windows, and usage limits. The flaw enables unauthorized disclosure of promotional data that site administrators intended to keep private.

Critical Impact
Any authenticated WordPress user can retrieve all coupon codes, including hidden ones, and apply them during bookings to obtain unauthorized discounts.

Affected Products

Salon Booking System WordPress plugin versions prior to 10.31.11
WordPress sites that permit user registration at the subscriber role or higher
Salon and appointment-based businesses relying on the plugin's coupon functionality

Discovery Timeline

2026-10-18 - CVE-2026-110035 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110035

Vulnerability Analysis

The Salon Booking System plugin exposes one of its REST API endpoints without a capability check restricting access to salon staff. Any user with an authenticated session, including the default subscriber role, can issue a request to the endpoint and receive the full coupon dataset in response.

The response payload includes coupon identifiers, discount values, validity dates, and per-coupon usage limits. Coupons configured as hidden from customers are returned alongside publicly advertised ones, defeating the administrator's intended segmentation between internal and public offers.

While the direct impact is confidentiality of coupon data, the downstream effect is financial. Attackers who harvest hidden coupon codes can submit bookings at reduced prices, consuming promotional budgets reserved for specific customer segments.

Root Cause

The root cause is a missing authorization check on the REST API route. The endpoint registers a permission_callback that validates authentication but not role or capability, treating any logged-in user as sufficiently privileged to read coupon data.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker registers or logs into any account on the target WordPress site, authenticates to obtain a session cookie or nonce, and issues an HTTP request to the vulnerable coupon endpoint. The server responds with the complete coupon list in JSON format.

For technical specifics, see the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-110035

Indicators of Compromise

Unexpected REST API requests from low-privilege user accounts targeting Salon Booking System endpoints under /wp-json/
Bookings submitted using hidden or staff-only coupon codes that were not publicly advertised
Spikes in coupon usage counters for coupons marked as hidden in the plugin administration panel

Detection Strategies

Review WordPress access logs for authenticated REST API calls to Salon Booking System routes originating from subscriber or other non-staff accounts
Compare the list of coupons marked hidden against coupon redemption history to identify unauthorized use
Enable REST API request logging via a WordPress security plugin and alert on calls to plugin endpoints by non-privileged roles

Monitoring Recommendations

Monitor the wp_users table for unexpected new subscriber registrations followed by REST API activity
Track HTTP 200 responses to /wp-json/salon-booking-system/ paths from non-administrative sessions
Correlate coupon redemption events with the account roles of users submitting bookings

How to Mitigate CVE-2026-110035

Immediate Actions Required

Upgrade the Salon Booking System plugin to version 10.31.11 or later on all WordPress installations
Audit existing coupons and rotate any hidden codes that may have been exposed to registered users
Review recent bookings for unauthorized use of hidden coupon codes and reconcile discount losses

Patch Information

The vendor addressed the issue in Salon Booking System version 10.31.11 by adding the appropriate capability check to the affected REST API endpoint. Site operators should update through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Advisory for release details.

Workarounds

Disable open user registration under Settings → General until the plugin is updated to prevent attackers from obtaining subscriber accounts
Restrict access to /wp-json/ endpoints at the web server or WAF layer for unauthenticated and low-privilege sessions
Temporarily deactivate the Salon Booking System plugin if coupons contain sensitive pricing data and an immediate update is not possible

bash

# Example: block REST access to the vulnerable plugin namespace at the Nginx layer
location ~ ^/wp-json/salon-booking-system/ {
    deny all;
    return 403;
}