⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Critical · CVSS 9.8

How to Fix CVE-2024-3229: CWE-434 Unrestricted Upload of File with Dangerous Type in Salon Booking System, Free Version

⚡ At a glance
SeverityCVSS 9.8, Critical
Actively exploited?No
Affectedwordpresschef Salon Booking System, Free Version (<= 10.2)
Fixed inNewer than 10.2 (per vendor advisory)
Type (CWE)CWE-434: Unrestricted Upload of File with Dangerous Type

What is CVE-2024-3229?

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

In short, a successful attacker gets remote code execution on the affected system. No confirmed in-the-wild exploitation is listed in CISA KEV at the time of writing, but the CVSS rating still warrants prompt patching.

Am I affected?

Check whether you run Wordpresschef Salon Booking System, Free Version in your environment, then compare your installed version against the Affected row above.

Check the installed version against the Affected row above using the product's standard version command or admin UI.

How to fix CVE-2024-3229

  1. Read the official vendor advisory linked at the bottom of this page and identify the exact patched build for your release train.
  2. Download the patched build of Salon Booking System, Free Version from the vendor's support portal. Use only signed images from the vendor.
  3. Back up configuration and, where supported, take a snapshot of the host or appliance before you start.
  4. Apply the update following the vendor's documented procedure. For clustered or high-availability deployments, patch the standby node first, fail over, then patch the previously active node.
  5. Restart the affected service or appliance if the upgrade procedure requires it.
  6. Re-run the version check from the previous section and confirm the build matches the fixed release.

Update the affected WordPress plugin or theme


# The fixed plugin version is listed in the vendor advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=cve
wp plugin update salon-booking-system-free-version

# Or, if you cannot patch immediately, deactivate the vulnerable plugin
wp plugin deactivate salon-booking-system-free-version

# Verify the running plugin version
wp plugin get salon-booking-system-free-version --field=version


# Vendor advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=cve
# Trigger the same WP-CLI flow from a Windows admin workstation
ssh wpadmin@<host> "wp plugin update salon-booking-system-free-version"

Verify the fix landed


# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=cve
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2024-3229 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch immediately

If patching has to wait, block external access to the affected service at the firewall and restrict to a small, audited management network. Enable any vendor-recommended detection rules or WAF signatures listed in the advisory. None of these are a substitute for the patch.

How to verify the fix worked

Confirm the running build of Salon Booking System, Free Version matches the fixed version listed by the vendor. Re-run any vulnerability scanner you used previously and confirm the finding for CVE-2024-3229 has cleared. Where the vendor publishes a detection rule or IOCs, sweep your logs for evidence of pre-patch exploitation.

Why this CVE matters

CVSS 9.8 (Critical) reflects either remote, unauthenticated exploitability, full impact on confidentiality / integrity / availability, or both. Most internal SLAs map a Critical rating to a 7-to-15 day patch deadline regardless of in-the-wild reports. Public-facing instances should be patched on the shorter end of that window.

Monitoring and detection

After you apply the patch, treat the affected component as a known-good baseline and watch for regression. Concrete steps:

Defensive hardening beyond the patch

Patching closes this specific CVE. A few common-sense controls reduce the blast radius of the next one in the same component:

Frequently asked questions

Other vulnerabilities in the same area that are worth patching alongside this one:

Is CVE-2024-3229 being actively exploited?

Not at the time of writing. It is not listed in CISA's Known Exploited Vulnerabilities catalog. That can change, so monitor the advisory and KEV catalog.

How severe is CVE-2024-3229?

CVSS rates it 9.8 (Critical). Treat it accordingly in your prioritisation queue.

Do I have to take Salon Booking System, Free Version offline to apply the patch?

That depends on your deployment topology. For high-availability or clustered setups you can usually patch one node at a time with no full outage. Standalone installs typically need a short restart. Always follow the vendor's documented upgrade steps.

References

*Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor's advisory before applying changes in production.*