Salon Booking System CVE-2026-110034

Exploitation requires (1) the vulnerable Salon Booking System plugin at a version before 10.31.11, (2) a publicly reachable booking/checkout flow, and (3) the attacker possessing a valid fixed-amount discount code whose value exceeds a booking's subtotal, because the plugin does not clamp the post-discount total to a minimum of zero. No account, authentication, or extra user interaction is needed beyond the normal booking submission (PR:N/UI:N). The key LIMITING factor is the discount-code requirement - the attacker must know a currently valid fixed-amount code, which is why complexity is rated high (AC:H); sites that do not issue fixed-amount discount codes are not realistically exploitable.

This is a low-severity business-logic flaw, and all available signals agree it is a low real-world priority. The CVSS 3.1 base score is only 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N): network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) and only a limited integrity impact (I:L) - no confidentiality or availability impact. The AC:H is justified because exploitation is gated on the attacker already knowing a valid discount code, a condition outside their direct control. A public exploit/write-up exists (WPScan), which raises the practical likelihood somewhat, but POC availability is NOT the same as active exploitation. This CVE is NOT in CISA KEV, and no EPSS score was supplied in the input, so widespread automated exploitation cannot be inferred from the data provided. The realistic impact is financial/data-integrity abuse (bookings stored with a negative total) rather than system compromise. Net: a genuine bug worth patching on a normal cycle, but not an emergency - there is no indication of mass exploitation and the impact is bounded to booking/pricing records.

A visitor to a salon's public WordPress booking page enters a known valid fixed-amount discount code against a booking whose subtotal is smaller than the discount, and the plugin fails to floor the result at zero, storing a confirmed booking with a negative total. A public WPScan write-up documents the issue, so the technique is known. No authentication or user interaction beyond the normal booking flow is required, but the attacker must already possess a valid discount code.