The Salon Booking System WordPress plugin (through 10.31.0) does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability. Any authenticated user—including a Subscriber or self‑registered customer account—can disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers. This lack of proper authorization allows the disclosure of sensitive customer data, violating privacy and confidentiality.

WordPress sites that have the free version of the Salon Booking System plugin installed with a version of 10.31.0 or earlier. The vulnerability is present in all releases up to that version, and the REST API must be accessible to logged‑in users for the flaw to be exploitable. Sites using newer plugin versions are not affected.

The flaw is exploitable only when the attacker has a WordPress login with at least basic read privileges. Because the endpoint lacks an ownership check, enumeration of booking identifiers allows passive data collection. The CVSS score is 4.3, and the EPSS score is < 1 %; it is not listed in CISA KEV. These metrics indicate a moderate severity but a very low likelihood of exploitation. The likely attack vector is an authenticated request to the exposed REST endpoint, and exploiting it has a low technical cost.