CVE-2026-6320
Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.
| CWE | CWE-22 |
| Vendor | wordpresschef |
| Product | salon booking system – free version |
| Published | May 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for wordpresschef salon booking system – free version
Be the first to know when new high vulnerabilities affecting wordpresschef salon booking system – free version are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
wordpresschef / Salon Booking System – Free Version
0 ≤ 10.30.25
References
Credits
daroo