# Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.10 - Authenticated (Salon Staff+) Server-Side Request Forgery via 'image_url' Parameter

- **ID:** WPSEC-2026-1098
- **Plugin:** Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (`salon-booking-system`), https://wordpress.org/plugins/salon-booking-system/
- **Affected versions:** all versions before 10.31.11
- **Fixed in:** 10.31.11 (Update to 10.31.11 or later.)
- **Severity:** Medium 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/salon-booking-system
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1098/

## Description

The Salon Booking System plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'image_url' parameter of the service and assistant REST API endpoints in all versions up to, and including, 10.31.10. This is due to the URL being fetched with file_get_contents() with no restriction on its destination, and the response being saved to the uploads directory. This makes it possible for authenticated attackers with access to the plugin's services or assistants, such as the Salon Staff role, to make requests from the web application to arbitrary locations, including internal services, and read the responses.

## References

- https://wpsec.com/vuln/WPSEC-2026-1098/
- https://plugins.svn.wordpress.org/salon-booking-system/tags/10.31.11/
- https://wordpress.org/plugins/salon-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1098/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.