CVE-2026-6320
published 2026-05-02CVE-2026-6320: The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.37%
29.1th percentile
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wordpresschef | salon_booking_system_free_version | <= 10.30.25 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
wordpresschef Salon Booking System Plugin up to 10.30.25 on WordPress Confirmation Email path traversal (EUVD-2026-26784)
vuldb·2026-05-02·CVSS 7.5
CVE-2026-6320 [HIGH] wordpresschef Salon Booking System Plugin up to 10.30.25 on WordPress Confirmation Email path traversal (EUVD-2026-26784)
A vulnerability has been found in wordpresschef Salon Booking System Plugin up to 10.30.25 on WordPress and classified as critical. This impacts an unknown function of the component Confirmation Email Handler. This manipulation causes path traversal.
This vulnerability appears as CVE-2026-6320. The attack may be initiated remotely. There is no available exploit.
GHSA
GHSA-8hm5-pp9f-v67c: The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10
ghsa_unreviewed·2026-05-02
CVE-2026-6320 [HIGH] CWE-22 GHSA-8hm5-pp9f-v67c: The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-02
Published