CVE-2026-57723
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A CSRF vulnerability in VikBooking Hotel Booking Engine & PMS allows an attacker to perform operations leading to Path Traversal. This issue affects all versions up to and including 1.8.12.
Risk Assessment
An attacker can exploit CSRF to manipulate files on the server, potentially leading to unauthorized data access or system compromise.
Recommendation
Immediately update the VikBooking Hotel Booking Engine & PMS plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in VikBooking Hotel Booking Engine & PMS
See all- CVE-2026-42762High
CVE-2026-42762 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-42737High
CVE-2026-42737 describes an improper limitation of a pathname to a restricted directory, leading to a Path Traversal vulnerability in the VikBooking Hotel Booking Engine. This issue affects versions from n/a through 1.8.9 inclusive.
- CVE-2026-15401High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.13 is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts.
- CVE-2026-15346Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected XSS via the 'category_id' parameter in all versions up to 1.8.13. An attacker can inject arbitrary scripts that execute when a victim clicks a link, but only in browsers supporting access keys.
- CVE-2026-6818High
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-12754Medium
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions up to and including 1.8.12 due to insufficient input sanitization and output escaping.
- CVE-2026-42683High
The VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to 1.8.8) has a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.