Salon booking system <= 10.31.8 - Unauthenticated Authentication Bypass via Predictable REST API Access Tokens
- ID
- WPSEC-2026-0428
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- from 3.26 before 10.31.9
- Remediation
- Update to 10.31.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-330
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Salon booking system on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.26 through 10.31.8 due to REST API access tokens being generated as a SHA1 hash of a hardcoded public salt, the user ID and the token creation time, stored in plaintext and never expiring. Tokens are issued to administrators and salon staff who log in to the plugin's API or open its PWA staff app. This makes it possible for unauthenticated attackers to compute a valid access token for such a user, including an administrator, by brute-forcing the token creation time, and then authenticate to the plugin's REST API as that user and, in versions 10.30.14 and later, to WordPress core REST API endpoints as well.
References
- https://wpsec.com/vuln/WPSEC-2026-0428/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.9/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS