WordPress Salon Booking Plugin: Arbitrary File Read via Email Attachments
The Salon Booking System – Free Version plugin for WordPress, specifically versions up to and including 10.30.25, is vulnerable to an arbitrary file read. The National Vulnerability Database reports this is due to the plugin’s public booking flow accepting attacker-controlled file-field values. These values are then stored and later used as trusted paths for email attachments.
This critical flaw enables unauthenticated attackers to read arbitrary local files on the server. The exfiltration vector is particularly insidious: the compromised files are sent out as attachments within booking confirmation emails. Given the unauthenticated nature of the exploit, the attack surface is broad.
This isn’t just a theoretical bug; it’s a direct path to sensitive data. Attackers can leverage this to pull configuration files, database credentials, or even source code, completely bypassing authentication. The CVSS score of 7.5 (HIGH) underscores the severity, pointing to network-exploitable access with high confidentiality impact.
What This Means For You
- If your organization uses the Salon Booking System – Free Version plugin on WordPress, you need to immediately check your version. Patching to a version beyond 10.30.25 is non-negotiable. Furthermore, audit your email logs for any unusual booking confirmation emails with unexpected attachments or file names. Assume compromise if you find any instances of the vulnerable version. This is a direct path to server compromise and data exfiltration.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
WordPress Salon Booking Plugin Arbitrary File Read via Email Attachment - CVE-2026-6320
title: WordPress Salon Booking Plugin Arbitrary File Read via Email Attachment - CVE-2026-6320
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-6320 in the WordPress Salon Booking plugin. This rule looks for requests to 'admin-ajax.php' with the 'salon_booking_get_attachment' action and a 'file_name' parameter containing '../', indicating an attempt to read arbitrary local files.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-6320/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=salon_booking_get_attachment'
cs-uri-query|contains:
- 'file_name='
cs-uri-query|contains:
- '../'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6320 | Arbitrary File Read | WordPress plugin: Salon Booking System – Free Version |
| CVE-2026-6320 | Arbitrary File Read | Affected versions: <= 10.30.25 |
| CVE-2026-6320 | Arbitrary File Read | Vulnerable component: public booking flow accepting attacker-controlled file-field values |
| CVE-2026-6320 | Arbitrary File Read | Attack vector: Exfiltration via booking confirmation email attachments |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 02, 2026 at 15:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7628 — CrazyrabbitLTC Mcp-Code-Review-Server Command Injection
CVE-2026-7628 — A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of the component...
CVE-2026-6817 — Cross-Site Scripting (XSS)
CVE-2026-6817 — The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter in all versions up to,...
CVE-2026-6525 — IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to
CVE-2026-6525 — IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4