WordPress Plugin Vulnerabilities

Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code

Description

The plugin does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.

Proof of Concept

Affects Plugins

Plugin icon
salon-booking-system
Fixed in 10.31.11

References

CVE
CVE-2026-110034

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
e3a64d4d-92db-4dbc-a0b5-58bca4d8b5c4

Timeline

Publicly Published
2026-10-16 (about 3 days ago)
Added
2026-10-16 (about 2 days ago)
Last Updated
2026-10-16 (about 2 days ago)

Other

Published
Title
Published
2026-10-06
Title
Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook
Published
2024-06-06
Title
Contact Form Builder, Contact Widget <= 2.1.7 - Authentication Request Bypass
Published
2024-03-29
Title
VS Contact Form < 14.8 - CAPTCHA Bypass
Published
2017-05-16
Title
WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks
Published
2026-09-24
Title
All-In-One Security (AIOS) < 5.4.9 - Subscriber+ Security Control Bypass via udrpc_action Format Parameter