The Salon Booking System WordPress plugin before version 10.31.3 fails to enforce authorization checks on several REST API endpoints. When an authenticated user, such as a subscriber, calls the exposed routes, the plugin returns full booking records for all customers, including personal identifying information. This flaw constitutes an improper access control vulnerability that permits a legitimate user with a low‑privilege role to view data they should not be able to access, resulting in a privacy violation and potential exposure of sensitive data to malicious actors with valid credentials.

WordPress installations that use the Salon Booking System plugin and have a version earlier than 10.31.3 are affected. The vulnerability applies to any site where the REST routes are accessible to authenticated users, such as subscribers, without the appropriate capability checks, regardless of the site’s overall security posture.

The CVSS score is 4.3, and the EPSS score is < 1%. This indicates no publicly documented exploitation and a low likelihood of exploitation. Because the flaw requires the attacker to have authenticated credentials, the risk is mitigated by the necessity of a valid user account. However, any compromised subscriber credential or phishing that yields such a credential would allow immediate data collection. The lack of a KEV listing suggests the vulnerability has not yet been actively exploited, but organizations should treat it as a moderate‑risk data exposure that could be leveraged by attackers who gain legitimate account access.