{"id":"CVE-2026-110035","revision":"4f3173ca5b04498a981c28fed281409a","records":[{"revision":"4f3173ca5b04498a981c28fed281409a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110035","aliases":[],"title":"Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route","description":"The Salon Booking System  WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.","state":0,"publishedAt":"2026-10-18T06:00:15.992+00:00","modifiedAt":"2026-10-18T11:12:30.568+00:00","affected":[{"ecosystem":"Vendor product","name":"Salon Booking System","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Salon Booking System\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"10.31.11\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/146eaa60-08e8-43b2-8d87-74e79261d422/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110035","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110035","identifiers":["CVE-2026-110035"]},"retained":false,"historicalAffected":[]}],"coverage":[]}