The Salon Booking System WordPress plugin before version 10.31.9 generates booking‑API access tokens by combining a hard‑coded constant with the token issuance timestamp, instead of using a cryptographically secure random source. This predictable construction allows an attacker who can approximate the moment a token was issued to compute a valid token and access the booking API as any staff member or administrator, bypassing authentication entirely and gaining full control over booking operations.

The vulnerability affects the Salon Booking System WordPress plugin in all releases prior to 10.31.9; no other vendors or product versions are reported.

Because the token algorithm is deterministic and based on an easily guessable time value, exploitability is high. The CVSS score of 4.8 indicates moderate severity, and with an EPSS score of < 1 % the likelihood of exploitation is considered moderate, though it could be significant if the plugin is widely deployed. The vulnerability is not listed in the CISA KEV catalog, but the potential for unauthorized administrator access makes it a serious risk.