Salon Booking System WordPress Plugin Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read has been identified in the Salon Booking System – Free Version plugin for WordPress, affecting versions through 10.30.25. The issue arises because the public booking flow accepts file-field values controlled by attackers. These values are later used as trusted paths for email attachments, enabling unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation emails.

Impact

Exploitation of this vulnerability allows for unauthorized reading of local files, with the possibility of exfiltrating this data through email attachments.

Remediation

Users are advised to update the Salon Booking System – Free Version plugin to version 10.30.26 or a newer patched version.