Vulnerabilities / Salon Booking System – Appointment Booking for Salons, Barbershops & Spas / WPSEC-2026-1095
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Subscriber+) Missing Authorization to Salon Data Read via REST API
Medium 4.3
CWE-862Fixed in 10.31.11
- ID
- WPSEC-2026-1095
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.11
- Remediation
- Update to 10.31.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to unauthorized access of data via the plugin's REST API in all versions up to, and including, 10.31.10. This is due to the REST permission check resolving a post type's 'read' capability to the core 'read' capability, which every logged-in user has. This makes it possible for authenticated attackers with Subscriber-level access and above to read salon records such as discounts, including their coupon codes, services and assistants.
References
- https://wpsec.com/vuln/WPSEC-2026-1095/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS