CVE-2024-4442 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2024-4442?

CVE-2024-4442 has a CVSS score of 9.1 (CRITICAL). This vulnerability allows unauthenticated attackers to delete arbitrary files on WordPress sites using the Salon booking system plugin. Attackers can delete critical files like wp-config.php, potentially leading to site takeover and remote code execution. All WordPress sites with this plugin installed are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to delete arbitrary files on WordPress sites using the Salon booking system plugin. Attackers can delete critical files like wp-config.php, potentially leading to site takeover and remote code execution. All WordPress sites with this plugin installed are affected.

💻 Affected Systems

Products:

Salon booking system WordPress plugin

Versions: All versions up to and including 9.8

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all WordPress installations with the vulnerable plugin version, regardless of configuration.

📦 What is this software?

Salon Booking System by Salonbookingsystem

View all CVEs affecting Salon Booking System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete site compromise via wp-config.php deletion allowing database access, followed by remote code execution and full server control.

🟠

Likely Case

Site defacement, data loss from deleted files, and potential privilege escalation leading to administrative access.

🟢

If Mitigated

Limited impact if file permissions restrict deletion or if the plugin is disabled, though the vulnerability remains present.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is straightforward to exploit as it requires no authentication and minimal technical skill.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 9.9 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3088196/salon-booking-system

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Salon booking system' and click 'Update Now'. 4. Verify the plugin version is 9.9 or higher.

🔧 Temporary Workarounds

Disable the plugin

all

Temporarily disable the vulnerable plugin until patching is possible.

wp plugin deactivate salon-booking-system

Restrict file deletion permissions

linux

Set strict file permissions on critical WordPress files to prevent deletion.

chmod 444 wp-config.php
chmod 444 wp-content/plugins/salon-booking-system/*

🧯 If You Can't Patch

Implement a web application firewall (WAF) to block malicious requests targeting the vulnerable endpoint.
Monitor file deletion logs and set up alerts for unauthorized file removal attempts.

🔍 How to Verify

Check if Vulnerable:

Check the plugin version in WordPress admin under Plugins > Installed Plugins. If version is 9.8 or lower, the site is vulnerable.

Check Version:

wp plugin get salon-booking-system --field=version

Verify Fix Applied:

After updating, confirm the plugin version is 9.9 or higher in the WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /wp-admin/admin-ajax.php with action=sln_remove_uploaded_file containing suspicious file paths
File deletion events in system logs for wp-config.php or other critical files

Network Indicators:

Unusual spikes in POST requests to admin-ajax.php endpoint
Traffic patterns matching exploit attempts for CVE-2024-4442

SIEM Query:

source="web_server_logs" AND uri="/wp-admin/admin-ajax.php" AND method="POST" AND (action="sln_remove_uploaded_file" OR params CONTAINS "sln_remove_uploaded_file")

📊 Metadata

CVE ID: CVE-2024-4442

CVSS v3 Score: 9.1 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE: CWE-22

Published: May 21, 2024

Last Updated: April 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4442, you might also want to check these: