PatchTheCVECVE-2024-4442: The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to,
CVE-2024-4442 is a critical-severity flaw (CVSS 9.1) affecting salon booking system. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. This was partially patched in 9.9, and s
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.2% (top 31%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2024-05-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-4442?
salon booking system: upgrade to 10.0. Exact commands for each OS are on this page.
Is CVE-2024-4442 being exploited?
CVE-2024-4442 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-4442 affect?
CVE-2024-4442 affects salon booking system. Severity is critical (CVSS 9.1). The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This make
How urgent is CVE-2024-4442?
Priority 54/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
WordPress vulnerabilities · PHP vulnerabilities
Related CVEs
- CVE-2025-32220 MEDIUM 5.4 UPGRADE Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploit
- CVE-2025-31560 HIGH 7.2 UPGRADE Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system salon-booking-system allow
- CVE-2024-9882 MEDIUM 4.8 UPGRADE The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1
- CVE-2024-4468 MEDIUM 4.3 UPGRADE The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data du
- CVE-2024-47316 MEDIUM 4.3 UPGRADE Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-bo