Description
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Published:
2026-10-16
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Salon Booking System | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Fri, 16 Oct 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data. | |
| Title | Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-10-16T06:00:14.281Z
Reserved: 2026-10-13T14:46:39.410Z
Link: CVE-2026-110012
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-16T07:17:10.140
Modified: 2026-10-16T07:17:10.140
Link: CVE-2026-110012
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.