The Salon Booking System – Free Version plugin for WordPress up to version 10.30.25 contains an Arbitrary File Read vulnerability. This flaw arises because the plugin's public booking flow accepts attacker-controlled file-field values, which are later trusted as file paths for email attachments. An unauthenticated attacker can exploit this to read arbitrary local files and exfiltrate them via booking confirmation emails.