CVE-2024-4442

Deeper analysis

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 9.8. The issue stems from insufficient validation of file paths supplied to an uploaded-file removal handler, allowing path traversal (CWE-22). Unauthenticated attackers can therefore supply crafted paths that cause deletion of arbitrary files on the server, including wp-config.php, which can lead to database credential disclosure and subsequent site takeover or remote code execution. The vulnerability was only partially addressed in version 9.9 and fully resolved in 10.0; CVE-2024-37231 is noted as a duplicate.

Unauthenticated remote attackers can exploit the flaw without any user interaction or authentication. By invoking the plugin’s AJAX file-removal endpoint with a malicious path parameter, an attacker can delete critical WordPress configuration files or other sensitive content, directly resulting in integrity and availability impacts rated at CVSS 9.1.

Public references point to the vulnerable code in RemoveUploadedFile.php and to subsequent WordPress plugin repository changesets that implement the necessary path sanitization. Site owners are advised to update immediately to version 10.0 or later; administrators unable to update should consider temporary mitigation such as disabling the booking plugin or restricting access to its AJAX endpoints.

EPSS for the CVE reached a peak of 0.3370 (current value 0.2671), indicating a noticeable increase in observed exploitation interest after disclosure.