CVE-2024-4442

CVE-2024-4442 is a critical arbitrary file deletion vulnerability affecting all versions up to and including 9.8 of the Salon booking system plugin for WordPress. This flaw stems from insufficient validation of uploaded file paths, allowing unauthenticated attackers to delete arbitrary files, including sensitive ones like wp-config.php. With a CVSS score of 9.1 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, potentially leading to site takeover and remote code execution. While there is no confirmed active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating high awareness and potential for future exploitation.