The Salon Booking System – Free Version plugin for WordPress contains a cross‑site request forgery vulnerability that arises from missing or incorrect nonce validation on the setCustomText action. An attacker can send a forged POST request with a specially crafted value that is interpolated into a PHP string literal and written to the plugin’s translate‑constants.php file. Because the sanitization performed by sanitize_text_field() does not neutralize characters needed to break out of that literal, the attacker can inject arbitrary PHP code and achieve remote code execution on the server, a high‑severity CSRF flaw (CWE‑352).

All installations of the Salon Booking System – Free Version that use version 10.30.32 or earlier are affected. The available data does not indicate a specific fix, so impacted sites need to check for an updated release or implement mitigations to protect their environment.

The CVSS score of 8.8 reflects a high severity for remote code execution. The EPSS score of less than 1% indicates that exploitation, while possible, is currently rare. The likely attack requires an administrator to be tricked into submitting a forged request, such as by clicking a malicious link. Although the flaw is not listed in the CISA KEV catalog, the potential impact remains significant, warranting prompt remediation.