{
 "id": "WPSEC-2026-1098",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1098/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1098/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1098/index.md",
 "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Server-Side Request Forgery via 'image_url' Parameter",
 "description": "The Salon Booking System plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'image_url' parameter of the service and assistant REST API endpoints in all versions up to, and including, 10.31.10. This is due to the URL being fetched with file_get_contents() with no restriction on its destination, and the response being saved to the uploads directory. This makes it possible for authenticated attackers with access to the plugin's services or assistants, such as the Salon Staff role, to make requests from the web application to arbitrary locations, including internal services, and read the responses.",
 "plugin": {
  "slug": "salon-booking-system",
  "name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "full_name": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas",
  "wordpress_org": "https://wordpress.org/plugins/salon-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/salon-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/salon-booking-system"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "10.31.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 10.31.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "10.31.11",
 "remediation": "Update to 10.31.11 or later.",
 "fix_released": "2026-10-15T09:09:44+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T11:27:45.241656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1098/",
  "https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/",
  "https://wordpress.org/plugins/salon-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/salon-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}