CVE-2026-110012 — Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authent…
Published: 2026-10-16 · CVSS: 4.3 · CVSS 3.1
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7