An unauthenticated path traversal vulnerability in the Salon Booking System plugin for WordPress allows attackers to read arbitrary local files via booking confirmation emails.

This is a path traversal flaw (CWE-22) caused by the public booking flow accepting attacker-controlled file-field values, allowing unauthenticated remote attackers to exfiltrate sensitive files.

Successful exploitation of this vulnerability enables unauthenticated attackers to read sensitive system configuration or credential files on the host server. This exposure can lead to complete confidentiality compromise of the underlying web application. The CVSS score of 7.5 reflects the high severity of remote data exfiltration without requiring any user interaction or privileges.

Immediate Action: Update the Salon Booking System plugin to version 10.30.26 or later, or disable the plugin immediately if an update is not available.

Proactive Monitoring: Monitor web server access logs for anomalous file requests and review outbound email logs for suspicious attachment activity related to the booking flow.

Compensating Controls: Deploy a Web Application Firewall rule to block path traversal sequences in booking parameters and restrict access to sensitive file paths.

Public Exploit Available: false

Organizations utilizing the Salon Booking System plugin must prioritize remediation by applying available vendor updates immediately. Because the vulnerability permits unauthenticated file exfiltration, leaving the software unpatched exposes the environment to severe data theft.