CVE-2026-110034 Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
Unauthenticated attackers can create bookings with negative totals using valid discount codes, bypassing payment logic in the Salon Booking System plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110034?
CVE-2026-110034 is a low-severity vulnerability in Unknown Salon Booking System, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Weakness: CWE-20
Which versions are affected by CVE-2026-110034?
How do I fix CVE-2026-110034?
No fix has been published for CVE-2026-110034 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110034 being exploited?
There is no known exploitation of CVE-2026-110034 in the wild and no public exploit code.
Sources
Also known as GHSA-9wc6-98h9-ghvq.