What is the CVSS score of CVE-2026-6320?

CVE-2026-6320 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Salon Booking System are affected by CVE-2026-6320?

The Salon Booking System WordPress plugin (versions ≤10.30.25) contains a critical path traversal vulnerability enabling unauthenticated attackers to read arbitrary files from affected servers and…

How to fix or mitigate CVE-2026-6320?

Within 24 hours: Identify all WordPress instances running Salon Booking System plugin and document current versions via admin dashboard or wp-cli. Within 7 days: Update Salon Booking System plugin to version 10.30.26 or later on all affected installations. Within 30 days: Audit server access logs for suspicious file path patterns in booking form submissions (POST parameters to booking endpoints) and review email logs for confirmation messages sent during the vulnerability window.

Salon Booking System CVE-2026-6320

EUVD-2026-26784 HIGH

Path Traversal (CWE-22)

2026-05-02 Wordfence

WordPress Path Traversal Wordpress Plugin Salon Booking System Free Version Wordpresschef

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 12:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 12:00 euvd

EUVD-2026-26784

Analysis Generated

May 02, 2026 - 12:00 vuln.today

CVE Published

May 02, 2026 - 11:16 nvd

HIGH 7.5

DescriptionCVE.org

The Salon Booking System - Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.

AnalysisAI

Arbitrary file read in Salon Booking System plugin for WordPress (versions ≤10.30.25) allows unauthenticated remote attackers to exfiltrate sensitive local files by injecting malicious file paths into booking form fields, which are then attached to confirmation emails sent by the system. Wordfence identified this path traversal vulnerability (CWE-22) with a CVSS score of 7.5, exploitable without authentication or user interaction. The vulnerability is confirmed patched in version 10.30.26 via changeset 3512110, though no CISA KEV listing or public exploit code has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper input validation in the Salon Booking System plugin's public-facing booking workflow. The affected component (cpe:2.3:a:wordpresschef:salon_booking_system_-_free_version:*:*:*:*:*:*:*:*) accepts file-field input during the booking process without adequate sanitization, storing attacker-controlled file paths directly. When the booking confirmation email is generated, the plugin treats these stored paths as trusted filesystem references for attachment inclusion. This represents a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability, commonly known as path traversal. The plugin's email attachment mechanism fails to validate that the referenced file originates from an intended upload directory, allowing traversal sequences like '../../../wp-config.php' to reference arbitrary files readable by the web server process. WordPress plugins running under typical LAMP/LEMP configurations inherit the web server's filesystem permissions, potentially exposing configuration files, database credentials, and other sensitive data stored on the server.

RemediationAI

Upgrade immediately to Salon Booking System version 10.30.26 or later, which implements input validation to prevent path traversal in file-field handling per changeset 3512110 (https://plugins.trac.wordpress.org/changeset/3512110/salon-booking-system). Update via WordPress admin dashboard (Plugins → Updates) or manually download from the official WordPress plugin repository. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable the booking form's file upload/attachment functionality in plugin settings-this breaks legitimate file attachment features but eliminates the attack vector entirely; (2) Configure web server permissions to restrict WordPress process access to only essential directories using chroot jails or AppArmor/SELinux policies-effective defense-in-depth but requires system administration expertise and may break other plugin functionality; (3) Deploy a web application firewall (WAF) with rules blocking directory traversal sequences (../, %2e%2e%2f, etc.) in POST request bodies to booking endpoints-provides detection/blocking capability but sophisticated encoding bypasses remain possible. Verify patch effectiveness by testing that booking confirmations no longer attach files from paths outside the intended upload directory. Review server logs for historical booking submissions with suspicious file paths (traversal sequences) as indicators of prior exploitation attempts.