The Salon Booking System WordPress plugin, before version 10.31.11, exposes a REST API endpoint that permits any authenticated user, such as a subscriber, to retrieve all discount coupon data. The endpoint returns details that the administrator has hidden from customers, including coupon amounts, valid dates, and usage limits. This flaw results in the unauthorized disclosure of sensitive discount information and represents a clear violation of data confidentiality requirements.

The vulnerability applies to the Salon Booking System WordPress plugin for all releases prior to 10.31.11. No specific vendor product version numbers are listed; the issue affects any installation of the plugin that has not been updated to 10.31.11 or higher.

Exploitation requires a valid authenticated user account but does not need elevated privileges; the attacker can query the endpoint to obtain hidden coupon information. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, indicating limited data on exploitation prevalence. Nevertheless, the information disclosure can provide an attacker with actionable pricing or discount data that may be used to manipulate user expectations or later exploit other system weaknesses. The risk is mainly in the confidentiality domain, with a moderate potential impact to the business if an attacker harvests coupon information for competitive or fraudulent use.