CVE-2024-30510: 
WordPress vulnerability analysis and mitigation

The Salon booking system plugin for WordPress contains an Unrestricted Upload of File with Dangerous Type vulnerability (CVE-2024-30510). This vulnerability affects versions up to and including 9.5, with a fix available in version 9.5.1. The issue was discovered and disclosed on March 28, 2024 (Patchstack).

The vulnerability stems from missing file type validation in the save_item_image() function. This security flaw has received a Critical CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) from NIST NVD, while Patchstack assigned it a CVSS score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (NVD).

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected site's server, which could potentially lead to remote code execution. This poses a significant security risk as attackers could gain unauthorized access to the website through uploaded malicious files (WPScan).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack can be performed remotely, making it particularly dangerous (Patchstack).

Website administrators are strongly advised to update the Salon booking system plugin to version 9.5.1 or later, which contains the fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).