# CVE-2026-110013: Salon Booking System WordPress plugin insecure token generation

Source: https://junglewise.ai/threats/cve-2026-110013-the-salon-booking-system-wordpress-plugin-before-10-31-9-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110013 · Severity: medium · CVSS 4.8 · Published 2026-10-16

The Salon Booking System WordPress plugin generates booking API access tokens using a predictable method instead of secure randomness, allowing attackers to forge valid authentication tokens. An attacker who can determine when a staff or administrator token was issued can compute a valid token and gain unauthorized access to the booking API, including full administrative privileges.

Technologies: [Salon Booking System](https://junglewise.ai/threats/technologies/salon-booking-system). Vendors: [Salon Booking System](https://junglewise.ai/threats/vendors/salon-booking-system).

## Quick answers

**Is CVE-2026-110013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110013 being exploited in the wild.

**How severe is CVE-2026-110013?** Medium severity, with a CVSS score of 4.8, published 16 October 2026.

**Which products and versions are affected?** Salon Booking System before 10.31.9.

**Is there a fix for CVE-2026-110013?** Yes: fixed in 10.31.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110013 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110013?** Check whether you run Salon Booking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.31.9

## Technical details

The plugin derives access tokens from a hardcoded value combined with the token issuance timestamp, making them predictable. An attacker with knowledge of the approximate token creation time can brute-force or compute valid tokens to impersonate staff or administrator accounts and access the booking REST API without authentication. A fix is available in version 10.31.9 and later.

## Affected products

- Salon Booking System Salon Booking System before 10.31.9

## Timeline

- 2026-10-14: disclosed
- 2026-10-31: patched: version 10.31.9

## References

- [https://wpscan.com/vulnerability/613ddaa0-a44f-4dd7-b679-ba1319e15ca1/](https://wpscan.com/vulnerability/613ddaa0-a44f-4dd7-b679-ba1319e15ca1/)

## Related threats

- [The Salon Booking System missing authorization in REST API endpoint](https://junglewise.ai/threats/cve-2026-110035-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin SSRF and stored XSS in image URL](https://junglewise.ai/threats/cve-2026-110033-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System WordPress plugin insufficient access control in customer editor](https://junglewise.ai/threats/cve-2026-110032-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [The Salon Booking System plugin privilege escalation](https://junglewise.ai/threats/cve-2026-110031-the-salon-booking-system-wordpress-plugin-before-10-31-11-does)
- [Salon Booking System WordPress plugin CSRF in REST API](https://junglewise.ai/threats/cve-2026-110015-the-salon-booking-system-wordpress-plugin-before-10-31-9-does)