CVE-2026-110033 Salon Booking System CVE debrief

Who should care

WordPress administrators and security teams responsible for managing the Salon Booking System plugin, especially those with untrusted Salon Staff or higher role users, should assess exposure and prioritize remediation to prevent potential disclosure of internal-only resources and execution of arbitrary scripts in the site's origin.

Why it matters

The vulnerability allows users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it. WordPress administrators and security teams should assess exposure and prioritize remediation.

• Potential disclosure of internal-only resources.
• Potential execution of arbitrary scripts in the site's origin.

Technical summary

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it. The plugin's lack of validation enables attackers to manipulate the server into reading internal resources and serving malicious content.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Salon Booking System plugin, especially those with untrusted Salon Staff or higher role users.

Recommended defensive actions

• Assess exposure and prioritize remediation for WordPress installations using the Salon Booking System plugin, especially those with untrusted Salon Staff or higher role users.
• Verify the plugin version and update to 10.31.11 or later if necessary.
• Restrict access to the Salon Booking System plugin to trusted users only.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.