CVE-2026-85127 in VikBooking Hotel Booking Engine & PMS Plugin
Summary
by MITRE • 09/18/2026
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.8.15 represents a critical security flaw rooted in improper input validation and lack of output encoding within its live chat functionality. This issue allows unauthenticated users, such as potential hotel guests or malicious actors scanning the site, to upload arbitrary files through the chat interface without any restriction on file type or content sanitization. The core technical failure lies in the server-side processing logic which accepts these uploads directly into a directory accessible by the application and fails to verify that the uploaded payload is benign. Instead of filtering out executable scripts like PHP or JavaScript, the system stores them as-is, creating a persistent foothold on the web server for any file type deemed acceptable by the underlying operating system permissions.
This lack of restriction enables an attacker to perform what is technically classified as Unrestricted File Upload, which falls under CWE-434 in the Common Weakness Enumeration standards. By uploading a malicious script disguised within a chat attachment, the attacker ensures that the content remains on the server indefinitely until manually removed by an administrator. The severity of this vulnerability escalates significantly due to its interaction with the administrative interface. When a site administrator logs into the WordPress dashboard and views the conversation history containing the uploaded file, the browser or the application context attempts to render or process the attached content. Because the input was not sanitized upon storage nor encoded upon retrieval, any active code embedded in the attachment is executed within the security context of that administrative session.
The operational impact of this flaw is severe and directly leads to Remote Code Execution (RCE) under specific conditions where the administrator interacts with the compromised chat log. This scenario aligns closely with CWE-79, commonly known as Cross-Site Scripting or Stored XSS, but in this context, it transcends simple client-side script injection because the execution environment is tied to an authenticated administrative session. If the uploaded file contains server-side code such as PHP, and if the web server configuration allows for the interpretation of scripts within that specific directory structure, the attacker can achieve full remote code execution on the host system. Even if only client-side JavaScript executes, it runs with elevated privileges associated with the admin user, allowing the theft of session cookies, manipulation of site settings, or further pivoting into the backend infrastructure.
From a threat intelligence perspective, this vulnerability maps to several techniques in the MITRE ATT&CK framework for both web applications and enterprise environments. It corresponds to T1505.003, which covers Web Shell components, as attackers often use uploaded files to maintain persistent access. Additionally, it relates to T1059, Command and Scripting Interpreter, particularly when PHP or JavaScript is used to execute system commands or exfiltrate data. The attack vector also touches upon T1189, Drive-by Client Side Execution, although the trigger here requires a specific user action (admin viewing the chat) rather than passive browsing, making it more akin to targeted social engineering if combined with deception tactics to lure an admin into opening the malicious attachment.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary and most effective solution is to upgrade VikBooking to version 1.8.15 or later, where these input validation controls have been implemented by the developers. For organizations unable to patch immediately due to compatibility concerns with other plugins, a temporary workaround involves restricting file upload types via server-level configuration such as .htaccess rules for Apache or location blocks in Nginx to deny execution of scripts in the uploads directory. Additionally, implementing strict Content Security Policy headers can help mitigate the impact if client-side code is executed by preventing inline script evaluation and unauthorized external resource loading.
Beyond technical patches, administrative hygiene plays a crucial role in reducing risk exposure. Administrators should be trained to exercise caution when reviewing chat logs or attachments from unverified sources, treating any unexpected file types with suspicion. Regular audits of uploaded files within the WordPress media library can help identify malicious payloads before they are accessed by privileged users. Furthermore, deploying Web Application Firewalls configured with rulesets that detect common web shell patterns and anomalous upload behaviors can provide an additional layer of defense against exploitation attempts targeting this specific weakness in older plugin versions.