Salon Booking System CVE-2026-6320

Public-facing booking form must be enabled and accessible-this is the default configuration for Salon Booking System plugin installations. The vulnerability exploits the core booking workflow functionality, not an optional feature. Exploitation requires only that the WordPress site accepts public booking submissions, which is the intended use case for this plugin. Attack success depends on: (1) Web server process having read permissions to target files (standard LAMP/LEMP configurations allow reading most WordPress directory files including wp-config.php); (2) Email delivery infrastructure successfully sending the confirmation email with malicious attachment (email server restrictions on attachment types or size could limit exfiltration, though common file extensions like .txt, .log, .php as raw text typically pass filters); (3) Attacker-controlled email address accepting the confirmation email (free email services work, though high-volume exploitation might trigger spam filters). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special access, configuration changes, or user interaction required beyond submitting a public booking form.

This vulnerability presents significant real-world risk despite moderate CVSS scoring. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms network-based exploitation requiring no authentication, privileges, or user interaction-the lowest possible barrier to entry. The singular focus on confidentiality impact (C:H/I:N/A:N) accurately reflects the file read nature, but understates the severity of potential data exfiltration. Attackers can target high-value files like wp-config.php (containing database credentials), .htaccess, server configuration files, and other plugins' sensitive data. The attack's dependence on email delivery introduces minor operational complexity but does not significantly raise the bar. No CISA KEV listing or public exploit code is identified at time of analysis, suggesting limited in-the-wild exploitation to date, though the straightforward attack vector and common plugin deployment (WordPress booking systems are widely used in small businesses) make weaponization trivial. The confirmed patch in changeset 3512110 provides a clear remediation path, but the large installed base of free WordPress plugins typically results in slow update adoption, leaving an extended vulnerability window. Priority should be elevated for sites processing sensitive customer data or running alongside other vulnerable components that could be chained with exfiltrated credentials.

An unauthenticated attacker visits the WordPress site's public booking page and submits a reservation through the Salon Booking System form. In a file-field parameter intended for customer uploads, the attacker injects a path traversal string like '../../../wp-config.php'. The plugin stores this malicious path without validation and processes the booking confirmation email, attaching the contents of wp-config.php (containing database credentials, salts, and API keys) to the email sent to the attacker-controlled email address provided during booking. The attacker retrieves sensitive configuration data from the email attachment, enabling secondary attacks such as database compromise or privilege escalation.