CVE-2024-4442 is a Critical (CVSS 9.1) arbitrary file deletion in the Salon Booking System plugin for WordPress, versions up to and including 9.8. Unauthenticated attackers can delete files, including wp-config.php. The record says 9.9 patched it partly and 10.0 sufficiently, so update to 10.0 or later.
What's affected
- Product: Salon Booking System, a WordPress plugin.
- Affected versions: all up to and including 9.8.
- Fixed version: the record says partially patched in 9.9 and sufficiently patched in 10.0. So 9.9 is not a safe stopping point. I did not fetch the changesets that the record links.
- Duplicate note: the record says CVE-2024-37231 appears to be a duplicate of this issue.
- Severity: Critical, CVSS 9.1, no privileges, with high integrity and availability impact.
- Exploitation: KEV is false.
How to check if you're exposed
Check the version:
wp plugin get salon-booking-system --field=version
Below 10.0 means you should update. A site on exactly 9.9 has a partial fix only, per the record. Also check that wp-config.php is still there, along with other critical files. A site that suddenly shows the WordPress install screen after losing its configuration file is a classic sign.
What to do now
- Check the plugin version on all sites.
- Update to 10.0 or later, and do not stop at 9.9.
- Confirm wp-config.php and other core files are intact.
- Take a backup before and after updating, and test restores.
- Make wp-config.php read only where your host allows, and review file permissions.
Why it matters
The record maps this to CWE-22, path traversal. The plugin's RemoveUploadedFile action takes a path from the request and deletes it without confirming it lies inside the upload area. Deleting wp-config.php makes WordPress behave as if it were new, which an attacker can use to take over the site.
The lesson of the partial fix in 9.9 is that file path checks are easy to get slightly wrong. When a record says a fix is partial, follow the version that the record calls sufficient.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 9.9 enough?
No. The record says 9.9 was only a partial patch and 10.0 is sufficient.
Why is deleting wp-config.php dangerous?
Without it, WordPress can restart its installation flow, letting an attacker connect the site to their own database.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4442 (published 2024-05-21) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
