UNKNOWN NVD

CVE-2026-110012

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, all

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.

References

https://wpscan.com/vulnerability/7253eae4-4759-4388-8120-500b9d7352c4/

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This unknown severity vulnerability was published on 2026-10-16 via NVD.

vulnfeed aggregates 14996 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.