PT-2026-36611 · WordPress · Salon Booking System

Daroo · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-6320

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Salon Booking System – Free Version versions prior to 10.30.26

Description The plugin allows unauthenticated attackers to read and exfiltrate arbitrary local files. This occurs because the public booking flow accepts attacker-controlled file-field values, which are subsequently used as trusted paths for email attachments in booking confirmation emails.

Recommendations Update the plugin to a version later than 10.30.25.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-6320

Affected Products

Salon Booking System

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-6320 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2050591802072219964 · Twitter Post
• https://t.me/cveNotify/161872 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3512110/salon-booking-system · Note
• https://t.me/CVEtracker/52527 · Telegram Post