CVE-2024-4442: 
WordPress vulnerability analysis and mitigation

The Salon booking system plugin for WordPress contains an arbitrary file deletion vulnerability (CVE-2024-4442) affecting all versions up to and including 9.8. The vulnerability was discovered on May 17, 2024, and was partially patched in version 9.9, with a complete fix implemented in version 10.0 (WPScan).

The vulnerability stems from improper validation of uploaded file paths prior to deletion operations. The issue has been assigned a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, indicating a high-severity issue with network accessibility and no authentication requirements (NVD).

This vulnerability allows unauthenticated attackers to delete arbitrary files on the affected system, including critical files such as wp-config.php. The successful exploitation could lead to site takeover and potential remote code execution (Wordfence).

The vulnerability is exploitable by unauthenticated attackers and requires no user interaction. The attack vector is accessible over the network, making it relatively straightforward to exploit (WPScan).

Users are strongly advised to update their Salon booking system plugin to version 10.0 or later, which contains the complete fix for this vulnerability. While version 9.9 includes a partial patch, it does not fully address the security issue (WPScan).