CVE-2026-84768: WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress VikAppointments Services Booking Calendar pluginto a version that resolves this vulnerability.Fixed in 1.2.21
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-level privileges to attempt exploitation. The attack vector is network-accessible and requires no user interaction.
Which plugin versions are affected?
VikAppointments Services Booking Calendar versions 1.2.20 and earlier are identified as affected.
What is the likely security impact?
The issue is an SQL injection vulnerability with high confidentiality impact and low availability impact. The supplied severity vector indicates no integrity impact.