CVE-2026-110012 — Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

CVE-2026-110012

Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming PUBLISHED

Description (CNA)

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

Affected (CNA)

Vendor / product	Versions
Unknown / Salon Booking System	affected 0 before 10.31.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7253eae4-4759-4388-8120-500b9d7352c4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.