EUVD-2026-70578
GHSA-v7pq-g882-3fqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running VikAppointments <=1.2.20
-
DeliverySend crafted request to booking endpoint
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExecute UNION/error-based query across database
-
ImpactExfiltrate user hashes and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the VikAppointments Services Booking Calendar plugin (<= 1.2.20) be installed and network-reachable on a WordPress site, with the vulnerable booking/calendar request path accessible - no authentication, credentials, or user interaction are needed (PR:N/UI:N), matching a default install where the booking front-end is publicly exposed. Limiting factors are minimal: the main constraints are that the specific plugin and an affected version must be present and the injectable endpoint reachable (not blocked by a WAF or access restriction); the exact vulnerable parameter is not disclosed in the provided advisory data. |
| Impact | The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which is the worst-case exposure profile for a public-facing booking site. The scope change (S:C) plus C:H reflects that a database read can pull data well beyond the plugin's own tables, while I:N/A:L indicates the primary demonstrated impact is confidentiality with limited availability effect rather than full write/RCE - so the 9.3 score is driven by exposure and confidentiality, not integrity. No EPSS score, KEV listing, or POC was provided, so exploitation is not confirmed to be active; however, unauthenticated WordPress-plugin SQLi is highly automatable and historically weaponized quickly once details circulate, so a mid-sized municipal IT team in boleslawiec running this plugin should treat patching as urgent rather than deferring on the absence of a public exploit. The main uncertainty is that the Patchstack advisory is the single source and does not disclose the exact injectable endpoint or fixed version. |
| Exploit ScenarioDerived | An attacker discovers a WordPress site running VikAppointments <= 1.2.20 and sends a crafted request to a booking/calendar endpoint with a malicious value in a vulnerable parameter, requiring no authentication or user interaction. Using a UNION- or error-based injection, they exfiltrate wp_users password hashes and secret keys across the whole database (S:C), enabling account takeover or further compromise. Such attacks are readily scriptable, so no public POC is needed for mass scanning. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.
RemediationAI
No vendor-released patched version is identified in the available data; the advisory only establishes that versions <= 1.2.20 are affected, so administrators should upgrade to the latest available VikAppointments release above 1.2.20 as soon as the vendor publishes one and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/vikappointments/vulnerability/wordpress-vikappointments-services-booking-calendar-plugin-1-2-20-sql-injection-vulnerability) for the fixed version. Until a patch is confirmed, deploy a WAF or virtual patch (Patchstack/Wordfence rules) to filter SQL metacharacters on the plugin's booking/calendar request parameters, restrict access to the booking endpoints where feasible, and consider temporarily deactivating the plugin on high-exposure sites - the trade-off being loss of appointment-booking functionality. Additionally, apply least-privilege to the database account and review logs for anomalous query patterns or UNION/error-based probing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the VikAppointments Services Booking Calendar plugin for WordPress, published by e4jvikwp (CPE cpe:2.3:a:e4jvikwp:vikappointments_services_booking_calendar). The root cause is CWE-89 (improper neutralization of SQL elements): user-supplied input reaches a database query without proper parameterization or sanitization, allowing an attacker to alter query structure. In a WordPress plugin context this typically means a request parameter (e.g. a filter, ID, ordering, or search field on a booking/calendar endpoint) is concatenated directly into a query executed via the shared WordPress $wpdb connection, so injected SQL runs against the entire wp_ database schema.
Know when Vikappointments Services Booking Calendar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with no interaction; scope change as $wpdb reads span the whole DB (C:H); SQLi typically permits limited writes (I:L); no clear availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
Articles & Coverage 1
Executive ViewAI
VikAppointments Services Booking Calendar plugin (WordPress, versions ≤1.2.20) contains an unauthenticated SQL injection vulnerability that exposes the entire WordPress database including user credentials, customer records, and booking information to unauthorized access. Any organization running this plugin faces immediate risk to customer data, regulatory compliance, and business operations. Urgent remediation is required.
No vendor-released patch identified at time of analysis. Interim mitigation: (1) Uninstall the plugin if operationally feasible; (2) If required for operations, implement Web Application Firewall (WAF) rules to block SQL injection patterns in booking-related parameters; (3) Apply least-privilege database access controls and isolate WordPress database credentials from other systems; (4) Enable comprehensive database query logging and monitor for unauthorized SQL patterns; (5) Establish and test data recovery and incident response procedures; (6) Network-segregate the WordPress application from critical infrastructure if not already isolated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenti
Exploit-DB