Salon Booking System EUVD-2026-103395

Exploitation requires any authenticated WordPress account at subscriber level or higher on a site running Salon Booking System before 10.31.11; practically this means the site must allow user registration (common for booking/appointment sites) or the attacker must already hold a low-privilege account. No administrator rights, user interaction, or special configuration are needed beyond having the vulnerable plugin active and reaching the exposed REST API endpoint. Limiting factors: sites that disable open self-registration substantially reduce the attacker pool, and impact is confined to disclosure of coupon data (codes, amounts, validity dates, usage limits) with no write access or broader data exposure.

This is a low-to-moderate priority issue that scores CVSS 4.3 (Medium), and the supporting signals are consistent with that modest rating rather than contradicting it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L), with a limited confidentiality-only impact (C:L) and no integrity or availability effect - matching the description of an authenticated subscriber reading coupon data via an unrestricted REST API endpoint. Publicly available exploit code exists (WPScan), which modestly raises real-world exploitability, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The combination of required authentication, information-disclosure-only impact, and a niche industry-specific product makes this a data-leak hygiene issue rather than a critical priority; it matters most on sites that allow open user self-registration. No conflicting signals were found between the CVSS vector and the description - both agree on authenticated, low-impact disclosure.

An attacker self-registers (or uses any existing low-privilege account such as a subscriber) on a WordPress site running a vulnerable Salon Booking System version, then calls the unrestricted REST API endpoint to enumerate every discount coupon, including codes the administrator deliberately hid from customers, along with their amounts, validity windows and usage limits. The attacker reuses the hidden high-value coupons for unintended discounts or shares them publicly. Publicly available exploit code (WPScan) lowers the effort required.