CVE-2026-110013
Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
Unknown Salon Booking System
CVSS
4.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 10.31.9Salon Booking SystemCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
Text from CVE List
Affected versions 1
- Salon Booking Systemaffected: all versions before 10.31.9CVE List