What is the CVSS score of CVE-2026-57723?

CVE-2026-57723 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of VikBooking are affected by CVE-2026-57723?

VikBooking Hotel Booking Engine & PMS WordPress plugin (versions ≤1.8.12) allows arbitrary file deletion via cross-site request forgery, enabling remote attackers to disable WordPress sites when they…

How to fix or mitigate CVE-2026-57723?

Within 24 hours: Scan WordPress installations to identify all systems running VikBooking ≤1.8.12 and document affected site inventory. Within 7 days: Disable and remove the plugin from all affected systems immediately; if the plugin is business-critical, contact the vendor to confirm patched versions beyond 1.8.12 are available and upgrade if possible. Within 30 days: Implement CSRF protection headers and tokens at the WordPress/WAF layer, deploy file-integrity monitoring on WordPress directories, and conduct phishing-awareness training for administrative users to reduce social-engineering attack surface.

VikBooking CVE-2026-57723

EUVD-2026-41097 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-01 Patchstack

GHSA-c847-9rm9-gc74

WordPress Path Traversal CSRF Vikbooking Hotel Booking Engine Pms Wordpress Plugin E4Jvikwp

7.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Remote CSRF needs no attacker privileges (PR:N) but requires admin interaction (UI:R); traversal deletes files beyond the plugin (S:C) causing availability loss (A:H), with no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:21 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal.

This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.

AnalysisAI

Arbitrary file deletion in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to and including 1.8.12) is reachable via a cross-site request forgery flaw that lets an attacker abuse a path-traversal-capable file operation. By tricking a logged-in administrator into visiting a malicious page, a remote unauthenticated attacker can forge a request that deletes arbitrary files on the WordPress host, potentially disabling the site. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The affected component is VikBooking, a commercial WordPress plugin (CPE cpe:2.3:a:e4jvikwp:vikbooking_hotel_booking_engine_&_pms) providing hotel booking and property-management functionality. The root cause is CWE-352 (Cross-Site Request Forgery): a state-changing file operation lacks anti-CSRF nonce validation, so an off-site request can trigger it using the victim's authenticated session. The tags further indicate a path-traversal primitive layered on top, meaning the vulnerable handler accepts an attacker-influenced file path (e.g., using ../ sequences) without proper canonicalization, allowing the deletion target to escape the plugin's intended directory and reach arbitrary files on the server.

RemediationAI

No vendor-released patch version was identified in the available data; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-12-csrf-to-arbitrary-file-deletion-vulnerability) should be consulted for the fixed release, and administrators should update VikBooking to any version later than 1.8.12 once confirmed by the vendor. Until a patched build is applied, reduce exposure by restricting access to the WordPress admin area (IP allow-listing or VPN) so the vulnerable authenticated endpoints cannot be reached through a victim's browser from arbitrary origins, deploying a WAF rule to enforce origin/referer checks on the plugin's file-management requests, and instructing administrators not to click untrusted links while logged in; the trade-off is that admin IP restrictions can hinder remote management and WAF origin enforcement may break legitimate integrations, so test before enforcing.