VikAppointments WordPress CVE-2026-15918

No special conditions are required beyond the plugin being installed and active with at least one publicly accessible booking, service search, or employee search page - the default configuration for any site using the plugin for its intended booking function. The sort parameter is processed on the public reviews list, meaning no WordPress login, no admin access, and no non-default configuration is needed. What limits exploitation: the site must have the VikAppointments plugin installed and enabled, and the specific servicesearch or employeesearch views must be publicly reachable (not blocked by authentication or access controls at the server level). The impact is limited to read-only database access - attackers cannot write, modify, or delete data via this vector.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 (High) and aligns well with the described vulnerability: network-accessible, low complexity, no authentication, and high confidentiality impact. The read-only nature of ORDER BY injection limits the impact to C:H with I:N/A:N - an attacker cannot directly write data or disrupt availability via this vector. No EPSS score was provided in the intelligence data; without it, quantitative exploitation probability cannot be stated. This vulnerability is not listed in the CISA KEV catalog and no POC has been identified, so it remains a high-risk theoretical priority rather than a confirmed active threat. The absence of authentication requirements and the reachability from a default public booking page make this broadly exploitable against any site with public-facing VikAppointments pages, raising real-world risk above what the absence of KEV/POC might suggest. The limiting factor is the specialized nature of the plugin - only service businesses using this specific booking plugin are exposed.

An unauthenticated attacker browses to any public-facing VikAppointments booking or employee/service search page and submits a crafted HTTP request in which the sort-order parameter contains injected SQL - for example, appending a UNION SELECT statement to exfiltrate the wp_users table. The backend constructs an ORDER BY clause that incorporates the unsanitized value, causing the database to return user login names and password hashes to the attacker without requiring any WordPress account. No public POC has been identified at time of analysis, but the vulnerability class (ORDER BY injection) is well-documented and low-barrier for any attacker familiar with SQL injection tooling such as sqlmap.