blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-15918

HIGH 7.5 CVSS 3.1
Published
August 5, 2026
Last modified
August 12, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required

Affected WordPress components

  • VikAppointments Services Booking Calendar Plugin · vikappointments
    Confirmed match Active
    Up to and including 1.2.19
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • e4jvikwp VikAppointments Services Booking Calendar — Up to and including 1.2.19

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/lib.vikappointments.php#L5907
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/lib.vikappointments.php#L6011
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/views/employeesearch/view.html.php#L74
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/views/servicesearch/view.html.php#L80
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1e49cf-86ac-4368-800a-4e46f72c975d?source=cve
  • nvd.nist.gov Official NVD record