CVE-2024-3229 is a critical vulnerability in the Salon Booking System – Free Version WordPress plugin caused by unrestricted file upload due to missing validation of file types and absent authorization checks in the SLN_Action_Ajax_ImportAssistants function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability affects all versions up to and including 10.2. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been disclosed yet.

An unauthenticated attacker can upload arbitrary files to the affected WordPress site, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, successful exploitation could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Additionally, restrict file upload permissions and monitor for suspicious activity related to file uploads on the affected site.