# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Subscriber+) Missing Authorization to Salon Data Read via REST API

- **ID:** WPSEC-2026-1095
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.11
- **Fixed in:** 10.31.11 (Update to 10.31.11 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1095/

## Description

The Salon Booking System plugin for WordPress is vulnerable to unauthorized access of data via the plugin's REST API in all versions up to, and including, 10.31.10. This is due to the REST permission check resolving a post type's 'read' capability to the core 'read' capability, which every logged-in user has. This makes it possible for authenticated attackers with Subscriber-level access and above to read salon records such as discounts, including their coupon codes, services and assistants.

## References

- https://wpsec.com/vuln/WPSEC-2026-1095/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1095/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.