CVE-2026-110033 in Salon Booking System Plugin
Summary
by MITRE • 10/18/2026
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Salon Booking System WordPress plugin prior to version 10.31.11 represents a critical server-side request forgery combined with an insecure file write operation, fundamentally compromising the integrity and confidentiality of the targeted web application. This flaw stems from a failure to properly validate user-supplied input before processing it on the backend. Specifically, when users possessing the Salon Staff role or higher interact with certain functionalities within the plugin, they can supply arbitrary URLs pointing to image resources. The system proceeds to fetch these resources server-side without verifying their legitimacy, origin, or safety, and subsequently writes the retrieved content directly to a publicly accessible directory using a filename chosen by the attacker. This lack of input validation creates a severe security gap that allows for both data exfiltration and remote code execution scenarios.
From an operational impact perspective, this vulnerability enables two distinct attack vectors depending on the attacker's intent. First, it facilitates unauthorized access to internal-only resources through server-side request forgery techniques. By directing the vulnerable script to fetch URLs pointing to local services or restricted areas of the network that are not accessible from the public internet, attackers can force the web server to retrieve sensitive data and return it via the response written to the public directory. This effectively bypasses access controls designed to protect internal infrastructure components, leading to potential disclosure of configuration files, database credentials, or other confidential information stored within the local environment. Second, and more critically for immediate compromise, the vulnerability allows attackers to upload malicious SVG files containing embedded JavaScript code. Because these files are written to a publicly accessible location with attacker-controlled filenames, they can be directly accessed by any user visiting the site. When an unsuspecting victim opens such a file in their web browser, the embedded script executes within the context of the website's origin, leading to cross-site scripting attacks that can steal session cookies, hijack administrative accounts, or deface the application.
This vulnerability aligns with several well-known industry standards and taxonomies used for classifying security flaws. It is primarily categorized under CWE-20 Improper Input Validation, as the root cause lies in the failure to sanitize or verify user-supplied data before processing. The mechanism of fetching external resources based on untrusted input corresponds closely to CWE-918 Server-Side Request Forgery (SSRF), which exploits the trust a server has in its own ability to make requests. Furthermore, the storage and subsequent execution of malicious scripts via uploaded files relates directly to CWE-436 Interpretation Conflict, where the system interprets an SVG file as executable code rather than just image data, often exacerbated by insufficient MIME type checking or extension validation. In terms of offensive security tactics, this vulnerability supports techniques found in the MITRE ATT&CK framework, specifically T1059 Command and Scripting Interpreter for executing arbitrary code via XSS, and potentially T1078 Valid Accounts if the attacker leverages compromised Salon Staff credentials to exploit the role-based access control weakness.
To mitigate these risks, immediate action is required by system administrators and developers managing instances of this plugin. The most effective remediation is upgrading the Salon Booking System WordPress plugin to version 10.31.11 or later, where these validation checks have been implemented. In cases where an upgrade is not immediately feasible, temporary mitigations should include restricting file upload capabilities for non-administrative users and implementing strict allowlists for permitted image formats and sources if the functionality permits external fetching. Additionally, deploying a Web Application Firewall with rules designed to detect SSRF patterns and malicious SVG payloads can provide a layer of defense against exploitation attempts. Regular security audits focusing on input validation and secure file handling practices are essential to prevent similar vulnerabilities in custom or third-party WordPress extensions.