CVE-2026-6320 in Salon Booking System Plugin
Summary
by MITRE • 05/02/2026
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/24/2026
The Salon Booking System – Free Version plugin for WordPress represents a critical security vulnerability that affects versions up to and including 10.30.25, creating a significant risk for WordPress installations. This vulnerability stems from improper input validation within the public booking flow mechanism, where attacker-controlled file-field values are accepted without adequate sanitization or verification. The flaw exists in the plugin's handling of user-submitted data during the booking process, specifically when processing file attachments that are later incorporated into confirmation emails. The vulnerability manifests as an arbitrary file read condition that allows unauthenticated attackers to access local files on the server through the booking confirmation email attachments, effectively bypassing normal access controls and permissions.
The technical implementation of this vulnerability involves the plugin's failure to properly validate and sanitize file paths submitted through the public booking interface. When users submit booking requests through the front-end form, the plugin accepts file-field values that are then stored and later used as legitimate paths for email attachments. This design flaw creates a path traversal condition where attacker-controlled input is directly used to construct file paths without proper validation or sanitization. The vulnerability operates at the application layer and can be exploited through a simple HTTP request containing malicious file path references that are then processed by the plugin's email attachment mechanism. This weakness aligns with CWE-22 Path Traversal and CWE-73 Path Traversal in Email Attachments, both of which represent common attack vectors for unauthorized file access.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with the capability to exfiltrate sensitive data from the affected WordPress installation. Attackers can leverage this vulnerability to access configuration files, database credentials, user information, and potentially other sensitive system files that may contain authentication tokens or other critical data. The exposure of these files through booking confirmation emails creates a persistent threat vector that can be exploited repeatedly without requiring authentication or prior access to the system. This vulnerability particularly affects businesses relying on the plugin for salon booking management, as it could expose customer data, internal system configurations, and potentially compromise the entire WordPress installation. The attack surface is amplified by the fact that this vulnerability affects the public-facing booking interface, making it accessible to anyone with internet access.
Mitigation strategies for this vulnerability should focus on immediate remediation through plugin updates to versions that address the file path validation issue. System administrators should implement network-level restrictions to prevent unauthorized access to the booking interface when updates are not immediately available. The implementation of proper input validation and sanitization mechanisms within the plugin's codebase is essential to prevent attacker-controlled values from being used as file paths. Organizations should also consider implementing email filtering rules to detect and block suspicious attachment content in booking confirmation emails. Additionally, the principle of least privilege should be enforced by ensuring that the WordPress installation and plugin files have minimal required permissions, limiting the potential damage from successful exploitation. This vulnerability demonstrates the importance of secure coding practices and input validation, particularly in web applications that handle user-submitted data in contexts where file system access is involved, and aligns with ATT&CK technique T1213 Data from Information Repositories for unauthorized data access and exfiltration.