CVE-2026-6320: wordpress salon-booking-system Path Traversal

Vulnerability summary

CVE-2026-6320 is a high (CVSS 7.5) Path Traversal vulnerability in wordpress salon-booking-system. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.9% of scored vulnerabilities. Fixed in 10.30.26.

Timeline

1. 02-05-2026
   PublishedVulnerability first disclosed.
2. 04-05-2026
   Last modifiedVulnerability information updated.

Description

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.