CVE-2026-110013

The Salon Booking System WordPress plugin before version 10.31.9 is vulnerable to unauthenticated Salon REST API access due to predictable access tokens. The root cause is that the plugin fails to use a secure random source, instead deriving tokens from a hardcoded value and the timestamp (second...