CVE-2024-43280: Salon Booking System Open Redirect Flaw

CVE-2024-43280 Overview

CVE-2024-43280 is an open redirect vulnerability in the Salon Booking System WordPress plugin. The flaw affects all versions from initial release through version 10.8.1. Attackers can craft URLs that appear to originate from a legitimate site hosting the plugin, then redirect victims to attacker-controlled destinations. This weakness maps to [CWE-601] URL Redirection to Untrusted Site.

The vulnerability requires user interaction, meaning a victim must click the malicious link. Successful exploitation supports phishing campaigns, credential harvesting, and malware distribution by abusing the trusted domain of the target WordPress site.

Critical Impact
Attackers can weaponize the trust of a legitimate WordPress site to redirect visitors to phishing pages or malicious payloads without triggering domain-based user suspicion.

Affected Products

Salon Booking System WordPress plugin versions up to and including 10.8.1
WordPress sites running the vulnerable plugin from salonbookingsystem
All deployments where the plugin is installed and reachable over the network

Discovery Timeline

2024-08-19 - CVE-2024-43280 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43280

Vulnerability Analysis

The Salon Booking System plugin accepts a redirect target through a request parameter without validating that the destination belongs to an allowlisted domain. When the plugin processes the parameter, it issues an HTTP redirect to the supplied URL. Attackers supply a fully qualified external URL and the server sends the victim to that location.

The request originates on the legitimate WordPress host, so the initial link matches the expected domain. Email gateways, link scanners, and end users evaluating the URL see a trusted origin. The redirect then transports the browser to an attacker-controlled site that can impersonate a login page or deliver a payload.

The vulnerability requires no authentication and only one user click to succeed. Exploitation is scriptable and can be embedded in phishing emails, chat messages, or malicious advertisements at scale.

Root Cause

The root cause is missing validation of a user-controlled redirect parameter. The plugin trusts the value supplied in the request and forwards it directly to a redirect function. There is no allowlist of internal paths and no check that the target host matches the WordPress site host.

Attack Vector

An attacker constructs a URL pointing to the vulnerable Salon Booking System endpoint with a redirect parameter set to an external malicious site. The attacker distributes the link through phishing, social media, or malvertising. The victim clicks the link, the WordPress server processes the request, and the browser follows a 302 redirect to the attacker destination. See the Patchstack Vulnerability Analysis for endpoint specifics.

Detection Methods for CVE-2024-43280

Indicators of Compromise

HTTP requests to Salon Booking System plugin endpoints containing redirect parameters with fully qualified external URLs
Web server access logs showing 302 responses with Location headers pointing to domains unrelated to the WordPress site
Spikes in referrer traffic from the WordPress domain landing on unfamiliar external hosts

Detection Strategies

Inspect web server and reverse-proxy logs for query parameters containing http://, https://, or protocol-relative // values directed at plugin routes
Correlate outbound redirect responses with newly registered or low-reputation domains using threat intelligence feeds
Flag inbound URLs whose parameter length or encoding deviates from normal booking workflow traffic

Monitoring Recommendations

Enable request logging on the WordPress instance and forward events to a centralized SIEM for parameter-level inspection
Add web application firewall (WAF) rules that alert when redirect parameters contain external hostnames
Monitor email gateway telemetry for outbound links pointing to the WordPress domain with suspicious redirect parameters

How to Mitigate CVE-2024-43280

Immediate Actions Required

Upgrade the Salon Booking System plugin to a version later than 10.8.1 as published by the vendor
Audit web server logs for prior exploitation attempts targeting plugin redirect endpoints
Notify users who may have received phishing links abusing the affected WordPress domain

Patch Information

The vendor addresses this issue in releases after version 10.8.1. Review the Patchstack Vulnerability Analysis for the fixed version and apply the update through the WordPress plugin manager or by deploying the patched package directly.

Workarounds

Deploy a WAF rule that blocks requests to Salon Booking System endpoints when redirect parameters contain external hostnames or protocol-relative prefixes
Restrict access to the plugin's redirect functionality using server-level rewrite rules until the patch is applied
Disable the Salon Booking System plugin on affected sites if the booking functionality is not business-critical

bash

# Example nginx rule to block external redirect targets on plugin endpoints
location ~* /salon-booking {
    if ($arg_redirect ~* "^(https?:)?//") {
        return 403;
    }
}