---
id: CVE-2026-110012
title: >-
  Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST
  bookings/upcoming
summary: >-
  The Salon Booking System  WordPress plugin before 10.31.3 does not restrict
  several of its booking REST API routes to users with the appropriate
  capability, allowing any authenticated user such as a subscriber to read every
  customer's bo…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: Salon Booking System
affected:
  - salon_booking_system < 10.31.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T14:38:36.764558Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T14:49:20.947Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110012'
references:
  - url: 'https://wpscan.com/vulnerability/7253eae4-4759-4388-8120-500b9d7352c4/'
tags:
  - cve.org
epss: 0.00149
epssPercentile: 0.03737
ingestedAt: '2026-10-16T07:01:11.487Z'
---

## Overview

The Salon Booking System  WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

## Affected

- `salon_booking_system < 10.31.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.