CVSS 4.3 (medium) ยท published 2026-10-16
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Weakness: CWE-200
Source: NVD CVE-2026-110012
Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.