Salon Booking System CVE-2026-110033

Requires an authenticated account with the plugin's 'Salon Staff' role or higher on a site running Salon Booking System before 10.31.11; the attacker abuses the image-URL fetch feature that does not validate the supplied URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename. The SSRF/disclosure path works on exploitation of this feature directly, while the stored-XSS path additionally requires a victim to open the planted SVG file (UI:R). Limiting factors: the privileged-role requirement (no anonymous exploitation) and, for the XSS, the need for victim interaction to open the malicious file.

This is a moderate-priority issue rather than a top-tier emergency, driven primarily by its privilege prerequisite. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R, C:H/I:H/A:H, score 6.8) shows a network-reachable, low-complexity flaw but gated behind an authenticated account - the description specifies the attacker must hold the 'Salon Staff' role or higher, and exploitation of the stored-SVG XSS path additionally requires a victim to open the planted file (UI:R). Publicly available exploit code exists (WPScan), which raises practical risk, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - the POC signal and the absence-of-exploitation signal point to opportunistic/targeted rather than mass exploitation. Two distinct weaknesses are bundled: a server-side request forgery / arbitrary file-write that discloses internal-only resources, and a stored XSS via malicious SVG; note the assigned CWE is only CWE-79 (XSS) and does not capture the SSRF/information-disclosure component, which defenders should account for. The PR:H rating is debatable - 'Salon Staff' is a custom, relatively low plugin role, not WordPress administrator, so the real barrier to entry may be lower than PR:H implies; verify the exact capability required against the vendor/WPScan advisory.

An attacker who has obtained or been granted a Salon Staff (or higher) account on a WordPress site running a vulnerable Salon Booking System plugin supplies a crafted 'image URL' pointing at an internal-only resource (e.g. a cloud metadata endpoint or internal service), causing the server to fetch it and write the response to a public path they can then read, disclosing internal data. The same feature lets them store a malicious SVG at an attacker-chosen filename; when any user (including an administrator) opens that file, embedded script executes in the site's origin. Publicly available exploit code (WPScan) lowers the effort required to reproduce both paths.