VikAppointments EUVD-2026-91958

Exploitation requires that the VikAppointments site has published at least one File-type custom field on the confirmation-page shortcode; this field is NOT created by default at installation, so stock/default deployments are not directly exploitable. When that field exists, the flaw is reachable remotely and without authentication (PR:N/UI:N) against affected versions up to and including 1.2.21, with no user interaction needed. The primary limiting factor is therefore this non-default configuration state; impact is maximized when a security-relevant file (e.g., wp-config.php) can be targeted, which enables site takeover/RCE.

This is a genuinely high-severity flaw but with an important real-world caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: a network-reachable, unauthenticated path-traversal file deletion (CWE-22) with high integrity and availability impact, and the deletion of a sensitive file such as wp-config.php plausibly escalates to RCE, justifying the 9.1 CRITICAL rating. However, the raw score overstates out-of-the-box exposure: exploitation is gated on a non-default configuration (at least one File-type custom field published on the confirmation-page shortcode), which is NOT created during plugin installation. This precondition is environmental rather than attacker-controlled, so it does not change PR (still unauthenticated) but it materially narrows the exploitable population - many installs will simply not have the required field. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active exploitation or mass-automatable attacks at this time. Net assessment: treat as a high priority to patch for any site that uses File-type custom fields on the confirmation page, but recognize that default/stock installations are not directly exploitable, making this closer to a conditional-critical than a universally wormable issue.

An unauthenticated attacker reaches the public confirmation-page shortcode of a VikAppointments site that has published a File-type custom field, and submits a crafted request to the plugin's file 'extract' handler containing directory-traversal sequences. The insufficient path validation lets the request resolve to a sensitive file outside the intended upload directory - deleting wp-config.php, which can force WordPress into its installation flow and enable takeover/RCE. No public exploit code was identified at time of analysis, and exploitation requires that the non-default File custom field be present.