What is the CVSS score of CVE-2026-15918?

CVE-2026-15918 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of VikAppointments WordPress are affected by CVE-2026-15918?

The VikAppointments Service Booking Calendar WordPress plugin contains an unauthenticated SQL injection vulnerability affecting any site running the plugin, enabling attackers to extract sensitive…

How to fix or mitigate CVE-2026-15918?

Within 24 hours: audit all WordPress installations for VikAppointments plugin presence; restrict public access to the affected servicesearch and employeesearch endpoints via firewall or Web Application Firewall rules blocking suspicious ORDER BY parameters; document inventory of affected sites. Within 7 days: disable or remove the VikAppointments plugin from all affected sites or implement reverse-proxy filtering as interim protection; begin evaluation of alternative booking plugins with proven security records. Within 30 days: complete migration to an alternative booking solution; reset passwords for all WordPress administrative accounts on affected sites and audit user account activity for indicators of compromise.

VikAppointments WordPress CVE-2026-15918

EUVD-2026-53038 HIGH

SQL Injection (CWE-89)

2026-08-05 Wordfence

GHSA-cg6f-7m34-r225

WordPress SQLi Wordpress Plugin Vikappointments Services Booking Calendar E4Jvikwp

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable from public page, no auth, low complexity; only confidentiality impacted as ORDER BY injection is read-only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 05:55 vuln.today

CVE Published

Aug 05, 2026 - 04:25 cve.org

HIGH 7.5

DescriptionCVE.org

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database - including sensitive information such as WordPress user credentials. No authentication or special privileges are required

AnalysisAI

Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.

Technical ContextAI

The affected product is the e4jvikwp VikAppointments Services Booking Calendar plugin for WordPress, identified by CPE cpe:2.3:a:e4jvikwp:vikappointments_services_booking_calendar:*:*:*:*:*:*:*:*. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause class. The specific code paths documented in the trac repository at version 1.2.19 show that a sort-order parameter from the HTTP request is interpolated directly into a SQL query's ORDER BY clause in lib.vikappointments.php without parameterization or allowlist validation. ORDER BY injection is a well-understood attack class where standard prepared statement defenses are insufficient unless the sort column/direction token is validated against a fixed allowlist before inclusion in the query. The vulnerability is exposed through two public-facing views - servicesearch (view.html.php L80) and employeesearch (view.html.php L74) - meaning it is reachable from any booking or search page without requiring a WordPress account.

RemediationAI

The primary remediation is to update the VikAppointments Service Booking Calendar plugin to the patched version as specified in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1e49cf-86ac-4368-800a-4e46f72c975d. The exact patched version is confirmed by Wordfence as the reporter but was not independently enumerated in the CPE data available - consult the advisory directly. If an immediate update is not possible, a compensating control is to restrict public access to the servicesearch and employeesearch views via web server rules (e.g., nginx location blocks or Apache mod_rewrite denying access to those WordPress views), though this disables the public booking search functionality. Alternatively, a WAF rule blocking SQL metacharacters (quotes, comment sequences, UNION/SELECT keywords) in sort-order parameters can reduce exploitation risk with minimal service disruption. WordPress administrators should also rotate the wp_users table credential hashes (force a password reset for all users) if exploitation cannot be ruled out, since those hashes are the primary sensitive data exposed.