WordPress Salon Booking Plugin Arbitrary File Read via Email

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled file-field values and later using those stored values as trusted paths for email attachments. This makes it possible for unauthenticated attackers to read arbitrary local files and exfiltrate them via booking confirmation email attachments.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Salon Booking System plugin for WordPress contains a path traversal vulnerability (CWE-22) that allows unauthenticated attackers to read arbitrary files from the server. The vulnerability exists in the public booking flow, which accepts user-controlled file path values without proper validation and later uses these paths as trusted references when attaching files to booking confirmation emails. This means an attacker can craft a malicious booking submission containing directory traversal sequences (like "../../../etc/passwd") to access sensitive files such as configuration files, database credentials, or source code, then receive them as email attachments. Any WordPress site running this plugin up to version 10.30.25 is vulnerable, affecting small businesses and service providers who rely on the plugin for appointment scheduling.

Casky's 331 matched skills leverage Claude AI's extended reasoning to detect the attack patterns associated with MITRE techniques TA0001 (Reconnaissance) and TA0007 (Discovery). Practitioners using Casky would identify suspicious booking submissions containing path traversal patterns in file field parameters, email logs showing unexpected attachments of system files, and access logs revealing requests to the booking endpoint with encoded traversal sequences like %2e%2e%2f. The platform's skill mapping would highlight how attackers perform reconnaissance by probing the booking form structure, then execute discovery activities by systematically reading files to map the server configuration—all without authentication. Security teams would see correlated findings showing the progression from initial form interaction through file exfiltration via email, enabling them to detect exploitation attempts before sensitive data leaves the server.

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-6320.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-6320 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn