Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Server-Side Request Forgery via 'image_url' Parameter
- ID
- WPSEC-2026-1098
- Plugin
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (salon-booking-system)
- Affected
- all versions before 10.31.11
- Remediation
- Update to 10.31.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Salon Booking System – Appointment Booking for Salons, Barbershops & Spas on WPSec AttackSurface
- Fix released
- Published
Description
The Salon Booking System plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'image_url' parameter of the service and assistant REST API endpoints in all versions up to, and including, 10.31.10. This is due to the URL being fetched with file_get_contents() with no restriction on its destination, and the response being saved to the uploads directory. This makes it possible for authenticated attackers with access to the plugin's services or assistants, such as the Salon Staff role, to make requests from the web application to arbitrary locations, including internal services, and read the responses.
References
- https://wpsec.com/vuln/WPSEC-2026-1098/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS