Arbitrary File Read Vulnerability in Salon Booking System by WordPress

CVE-2026-6320

What is CVE-2026-6320?

The Salon Booking System - Free Version plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the public booking flow. This vulnerability arises when the plugin accepts attacker-controlled values for file fields, which are later used as trusted paths for email attachments. As a result, attackers can read sensitive arbitrary local files and potentially exfiltrate them through booking confirmation emails, posing a significant security risk to users and their data.

References