The Salon Booking System – Free Version plugin for WordPress allows a malicious actor to inject arbitrary PHP code into the web‑accessible translate‑constants.php file via the setCustomText action. The flaw arises because the ‘value’ POST parameter is sanitized with sanitize_text_field() but still contains characters that break out of the PHP string literal written by file_put_contents(). This bypass of nonce validation enables remote code execution on the server when a vulnerable page is written.

All installations of Salon Booking System – Free Version plugin for WordPress up to and including 10.30.32 are affected. No official fix is currently available, so any site running a vulnerable version must upgrade to a patched release or otherwise mitigate the flaw.

The CVSS score of 8.8 indicates a high severity. Based on the description, it is inferred that the attacker must convince a logged‑in site administrator to submit a forged request that exploits the missing nonce check, for example by clicking a malicious link or submitting a crafted form. The EPSS score is less than 1%, indicating that exploitation in the wild is currently rare, but the vulnerability still poses a significant risk due to the potential for remote code execution. The issue is not yet listed in CISA KEV.