Salon Booking System CVE-2026-110013

Exploitation requires that the plugin's booking-API token generation is in use (any site running Salon Booking System before 10.31.9) and, critically, that the attacker can constrain the one-second timestamp at which a staff or administrator token was issued - tokens are derived deterministically from a value hardcoded in the plugin plus the issuance second, so knowing or narrowing that moment is the core prerequisite (reflected as AC:H). No authentication is needed (PR:N) and no victim interaction (UI:N). Limiting factors: the attacker must correlate or induce a privileged token issuance event to bound the time window; broad, blind exploitation is impractical, which is consistent with the low EPSS and absence from CISA KEV.

This is a genuine authentication-bypass flaw (CWE-287) but the real-world urgency is moderate, not critical. The signals are internally consistent rather than conflicting: the NVD CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N = 4.8 Medium) pairs network, unauthenticated reach (PR:N) with high attack complexity (AC:H), and that AC:H is well-justified - the description states the attacker must 'constrain when a staff or administrator token was issued,' i.e. they must know or narrow the second-granularity issuance time to compute the token. EPSS is low (0.14%, 3rd percentile) and the CVE is NOT on CISA KEV, so there is no evidence of widespread or active exploitation. However, a public exploit exists (publicly available exploit code exists, per WPScan), which raises the practical likelihood above a theoretical-only bug. The one tension worth flagging: NVD rates impact as only C:L/I:L, yet the description says a successful attack yields access 'as that user, including an administrator' - administrator impersonation via the booking API plausibly warrants higher confidentiality/integrity impact than NVD assigned (see assessed vector below); verify the true blast radius of the booking API with the vendor. Net: prioritize patching on exposed sites, but this is a medium-risk, complexity-gated issue rather than a drop-everything emergency.

An unauthenticated attacker triggers or observes the issuance of an administrator/staff booking-API token (for example by inducing an action at a known time), then reconstructs the token from the plugin's hardcoded seed and the one-second issuance timestamp, brute-forcing the small time window. Using the forged token, they call the booking API as that administrator to read customer data or manipulate bookings. Publicly available exploit code (WPScan) lowers the skill barrier, though the AC:H timing constraint still limits reliability.