VikBooking EUVD-2026-41097

Exploitation requires a victim who is currently authenticated to WordPress with sufficient privileges to invoke the plugin's file-management functionality (typically an administrator) and who must perform user interaction - visiting an attacker-controlled page or clicking a crafted link (UI:R) - while that session is active. The attacker themselves needs no credentials (PR:N) and only network reachability to the target site. Exploitation is limited by these factors: it fails if the admin is not logged in, if same-site cookie protections or an existing nonce/origin check block the forged request, or if admin access is network-restricted; the attacker also cannot directly choose when the victim interacts.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H, base 7.4) reflects a network-reachable, low-complexity attack requiring no attacker privileges but requiring victim interaction (UI:R), with a changed scope and a high availability impact only - no confidentiality or integrity loss is scored despite the primitive being file deletion, which is a notable NVD/Patchstack scoring choice worth verifying since deleting files arguably harms integrity as well. Because this is CSRF, the PR:N rating describes the attacker, not the operation: successful exploitation still hinges on a logged-in privileged user (typically an administrator) being social-engineered into clicking a crafted link, which meaningfully lowers real-world exploitability compared to a direct unauthenticated RCE. No EPSS score, KEV entry, POC, or SSVC data was supplied, so exploitation likelihood cannot be quantified; on available signals this is a credible but interaction-gated issue rather than a mass-exploitation candidate.

An attacker hosts a web page containing a hidden auto-submitting form or image request that targets the VikBooking file-deletion handler with a traversal path such as ../../../../wp-config.php. They send the link to a hotel's WordPress administrator, and when that logged-in admin opens it, the browser silently submits the forged request under the admin's session, deleting the targeted file and potentially taking the site offline. No public POC is currently identified, but the low attack complexity makes weaponization straightforward.