The Salon Booking System WordPress plugin prior to 10.31.11 subtracts a fixed‑amount discount from a booking total but does not enforce a minimum of zero. This omission allows an unauthenticated visitor who knows a valid discount code to submit a booking request that results in a negative total. The booking is stored as confirmed and visible to administrators, potentially creating phantom reservations and allowing attackers to claim negative balances or manipulate the system’s financial records.

The vulnerability affects the Salon Booking System plugin for WordPress from any unknown vendor, versions older than 10.31.11. No further granularity is available regarding sub‑versions or supported platforms beyond WordPress hosting environments.

The CVSS base score of 3.7 indicates a low‑to‑medium severity; the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack path is straightforward: an unauthenticated user needs only the knowledge of a valid discount code and can craft a booking request that the server accepts and stores with a negative total. Because the request is processed without authentication, the exploitation requires only the victim’s public IP or a router capable of receiving HTTP requests, and it does not rely on user interaction beyond the initial request.