CVE-2026-110034 — Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthe…
Published: 2026-10-19 · CVSS: 3.7 · CVSS 3.1
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7