CVE-2026-15918: VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection
VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15918?
The severity of CVE-2026-15918 is rated as high with a score of 7.5.
How do I fix CVE-2026-15918?
To fix CVE-2026-15918, update the VikAppointments plugin to the latest version where the SQL injection vulnerability has been patched.
What type of vulnerability is CVE-2026-15918?
CVE-2026-15918 is an unauthenticated SQL injection vulnerability affecting the VikAppointments plugin.
Who is affected by CVE-2026-15918?
Any WordPress site using the VikAppointments – Services Booking Calendar plugin version 1.2.19 or earlier is susceptible to CVE-2026-15918.
What can attackers do with CVE-2026-15918?
Attackers exploiting CVE-2026-15918 can manipulate SQL queries, potentially accessing sensitive database information without authentication.