The Salon Booking System WordPress plugin (up to 10.30.33) has a missing authorization check on one of its REST API endpoints. The endpoint permits any authenticated user to specify a booking identifier and receive that booking’s personal information – name, email, phone, address, and private notes – without verifying the requester owns the booking. This flaw lets an attacker with the lowest user role, such as a Subscriber or a self‑registered customer, enumerate booking IDs and exfiltrate the personal data of any customer, which is a direct violation of privacy and confidentiality.

Users running the Salon Booking System WordPress plugin version 10.30.33 or earlier. The vulnerability is present in all releases through the specified version and applies to any site where the plugin is installed and the REST API is exposed to logged‑in users.

The vulnerability is exploitable only with an authenticated WordPress account, but the required privileges are minimal (basic read) and typically granted to low‑privilege roles. The lack of an access-control gate means enumeration of booking identifiers leads to data disclosure. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, but the inherent sensitivity of the exposed data gives the flaw a high business impact. The likely attack vector is an authenticated request to the vulnerable REST endpoint, and the exploit cost is low, enabling potential compromise of customer privacy.