The Salon Booking System – Free Version plugin for WordPress is vulnerable to an arbitrary file read flaw that arises from the public booking flow admitting user‑controlled file‑field values, which are later treated as trusted paths for email attachments. This design flaw allows path traversal, supplying a likely attack vector that exploits the publicly accessible booking endpoint without authentication, enabling an attacker to read any file on the server and exfiltrate it via booking confirmation email attachments.

The flaw affects WordPress sites running the Salon Booking System – Free Version plugin with versions 10.30.25 and earlier. No specific manufacturer beyond the WordPress plugin is indicated beyond the vendor/brand name used by the CNA.

The CVSS score of 7.5 indicates a medium‑high severity, reflecting the ability to read sensitive files. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not yet listed in CISA’s KEV catalog, suggesting no known public exploits, though the flaw permits unauthenticated compromise and data exfiltration. Attackers would likely exploit the public booking flow to supply a path‑traversal string, trigger the email attachment generation, and receive the file contents via the resulting email.