Salon Booking System EUVD-2026-102691

Exploitation requires the attacker to hold any authenticated WordPress account on the target site - specifically the low-privilege subscriber role is sufficient (PR:L), so the practical precondition is that the site allows self-service user registration or the attacker otherwise obtains a low-level credential. The exact vulnerable surface is the plugin's booking REST API routes, which fail to enforce the capability check that should gate access to customer booking records. Limiting factors: no exploitation is possible by a fully unauthenticated visitor, no admin privileges are needed, and the impact is read-only disclosure (no write or availability effect). Sites that disable open registration and have no untrusted low-privilege users substantially reduce exposure.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 4.3 (Medium) reflects the key limiting factor: AV:N/AC:L/PR:L/UI:N - remotely reachable over the REST API with low attack complexity, but requiring an authenticated account (PR:L). Impact is confidentiality-only (C:L/I:N/A:N), consistent with CWE-200 information disclosure. EPSS is very low at 0.15% (4th percentile), indicating no statistical signal of mass exploitation, which aligns with the absence of a CISA KEV listing (KEV=NO). Counterbalancing this, publicly available exploit code exists (published by WPScan), which lowers the skill barrier and makes opportunistic abuse plausible on sites where low-privilege registration is open. The signals are internally consistent rather than conflicting: low EPSS + no KEV + Medium CVSS + PR:L all point to a real-but-bounded data-exposure flaw rather than a wormable or widely-weaponized vulnerability. The main risk amplifier not captured by the base score is that a single subscriber can enumerate EVERY customer's records, turning a 'Low' confidentiality rating into a potential bulk-PII breach on a vulnerable site.

On a WordPress site running Salon Booking System before 10.31.3 that permits open user registration, an attacker registers a free subscriber-level account, then sends authenticated requests to the plugin's booking REST API routes. Because those routes lack a capability check, the attacker harvests the booking records and personal data of all customers. A public exploit from WPScan already documents the vulnerable endpoints, so no original research is needed.