Vulnerability · Published Oct 16, 2026 · Assigned by WPScan

CVE-2026-110013Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

Medium 4.8

In plain English

A medium-severity improper authentication in Salon Booking System from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 94.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Salon Booking System	0 – before 10.31.9

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/613ddaa0-a44f-4dd7-b679-ba1319e15ca1/ exploit, vdb-entry, technical-description