CVE-2026-15918 in VikAppointments Service Booking Calendar Plugin
Summary
by MITRE • 08/05/2026
VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in the VikAppointments Service Booking Calendar wordpress plugin represents a critical security flaw that exposes sensitive data through an unauthenticated sql injection vector. This weakness stems from improper input validation within the plugin's review sorting functionality, where user-supplied parameters directly influence database query construction without adequate sanitization measures. The affected parameter controls how public reviews are displayed and is derived from incoming http requests, creating a direct pathway for malicious actors to manipulate database queries through standard website navigation.
The technical implementation of this vulnerability aligns with common sql injection attack patterns documented in the cwe dictionary under cwe-89, which describes improper neutralization of special elements used in sql commands. Attackers can exploit this flaw by crafting malicious requests that inject sql code into the sorting parameter, enabling them to execute arbitrary database operations against the wordpress installation's backend. The vulnerability specifically targets the plugin's public review display functionality, where the sorting mechanism fails to validate or sanitize incoming data before incorporating it into database queries.
The operational impact of this vulnerability extends beyond simple data theft, as it provides attackers with access to potentially sensitive user information including wordpress administrator credentials and other database records. Since no authentication is required to exploit this flaw, threat actors can perform attacks from any public network position without requiring prior access or privileges. This makes the vulnerability particularly dangerous in environments where wordpress installations are publicly accessible and where the plugin's review functionality is enabled. The exposure of user credentials could lead to complete system compromise through unauthorized administrative access.
Mitigation strategies for this vulnerability should focus on implementing proper input validation and parameterized queries within the plugin codebase. Developers must ensure that all user-supplied parameters are validated against expected values and sanitized before being incorporated into database operations. The fix should involve replacing direct parameter insertion with prepared statements or similar secure coding practices that separate sql command structure from data values. Organizations should also implement network-level protections such as web application firewalls to detect and block suspicious sql injection attempts, while maintaining regular security updates for wordpress plugins and core installations. Additionally, this vulnerability demonstrates the importance of following owasp top ten security guidelines, particularly those addressing injection flaws and inadequate input validation. The attack surface could be reduced by implementing least privilege principles and limiting direct database access from web applications to only necessary operations.