---
id: CVE-2026-110035
title: >-
  Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via
  Discounts REST Route
summary: >-
  The Salon Booking System  WordPress plugin before 10.31.11 does not restrict
  one of its REST API endpoints to salon staff, allowing any authenticated user,
  such as a subscriber, to retrieve every discount coupon configured on the
  site, i…
severity: none
cwe:
  - CWE-284
product: Salon Booking System
affected:
  - salon_booking_system < 10.31.11
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T06:00:15.992Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110035'
references:
  - url: 'https://wpscan.com/vulnerability/146eaa60-08e8-43b2-8d87-74e79261d422/'
tags:
  - cve.org
ingestedAt: '2026-10-18T06:38:27.438Z'
---

## Overview

The Salon Booking System  WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.

## Affected

- `salon_booking_system < 10.31.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.