Unauthenticated SQL Injection in VikAppointments WordPress Plugin

CVE-2026-15918 affects the VikAppointments Service Booking Calendar WordPress plugin. The vulnerability arises from improper neutralization of special elements used in an SQL command during the processing of sorting parameters for public review lists. An unauthenticated attacker can supply crafted input to the affected parameter via a standard HTTP request to the booking page. This input is processed by the application to dynamically build a database query without sanitization or parameterization.

Successful exploitation results in the ability to execute arbitrary SQL commands against the backend WordPress database. This impact includes unauthorized read access to database tables, potentially exposing sensitive data such as administrative credentials, user sessions, and private service booking details. Given that the vulnerability requires no authentication and is accessible through publicly exposed pages, it presents a significant risk to site integrity and data confidentiality. Defenders should prioritize patching the plugin to the latest version, as this is the primary remediation for the underlying SQL injection flaw.

Impact

The vulnerability poses a high risk to WordPress environments, as it allows unauthenticated remote attackers to bypass application logic and extract data from the database. Potential damage includes full database compromise, leading to account takeover (via credential dumping) and unauthorized access to proprietary booking information. No victim counts or sector-specific exploitation data is currently available, but the nature of the plugin suggests potential targeting of business websites that handle appointment scheduling.

Recommendation

• Update the VikAppointments Service Booking Calendar plugin to the latest vendor-supplied version to remediate the vulnerability associated with CVE-2026-15918.
• Implement a Web Application Firewall (WAF) rule to inspect incoming HTTP requests for common SQL injection patterns targeting public booking and review parameters.
• Audit web server logs for suspicious database query strings occurring in HTTP GET/POST requests targeting the appointment booking paths.