{"schemaVersion":3,"id":"CVE-2026-6320","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.","dates":{"published":"2026-05-02T11:16:11.330Z","modified":"2026-05-04T15:37:04.821Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00546,"percentile":0.44929,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.173,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00373},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00546,"percentile":0.44929}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00373,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00546,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00546,"percentile":0.44929}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"wordpress","product":"salon-booking-system","name":"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas","label":"salon-booking-system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 10.30.25 (fixed in 10.30.26)","noFixRecorded":false,"fixedIn":"10.30.26"}],"versionsText":"≤ 10.30.25 (fixed in 10.30.26)","eol":null,"hubHref":null},{"vendor":"wordpresschef","product":"salon booking system – free version","name":"Salon Booking System – Free Version","label":"salon booking system – free version","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 10.30.25","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 10.30.25","eol":null,"hubHref":"/vendor/wordpresschef/salon_booking_system_-_free_version"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854?source=cve","hostname":"www.wordfence.com","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3512110/salon-booking-system","label":"plugins.trac.wordpress.org/changeset/3512110/salon-booking-system","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854","label":"www.wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-05-02T11:16:11.330Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-04T15:37:04.821Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T00:37:00.006Z","stale":false,"partial":false}}