CVE-2024-37231 HIGH

CVE-2024-37231: WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability

Vendor Salon Booking System
Product Salon booking system
Weakness CWE-22 · Path traversal
Published June 24, 2024
Last update April 28, 2026

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.This issue affects Salon booking system: from n/a through 9.9.

Explanation of Vulnerability in Simple Terms

02Summary

The Salon Booking System contains a path traversal vulnerability that allows an unauthenticated attacker to cause a denial of service by sending specially crafted requests over the network. The vulnerability affects versions up to 9.9. No authentication or user interaction is required to exploit this issue, and the impact extends beyond the vulnerable component itself.

What an attacker can do

03Attacker Capabilities

Make the site unavailable or unresponsive by sending malicious requests.

Potential impact on your site

04Site Impact

Your booking system may become unavailable or slow to respond without warning.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE