CVE-2026-84768

CriticalCVSS 9.3

Published: 03/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

Unauthenticated SQL Injection vulnerability in VikAppointments Services Booking Calendar versions up to 1.2.20. An attacker can inject SQL queries, potentially leading to unauthorized database access.

Risk Assessment

An unauthenticated attacker could access booking and other database data, leading to data leakage and privacy breach.

Recommendation

Update the VikAppointments Services Booking Calendar plugin to the latest patched version.

Other vulnerabilities in VikAppointments Services Booking Calendar

CVE-2026-87115Critical
The VikAppointments Services Booking Calendar plugin for WordPress up to version 1.2.21 is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution (e.g., by deleting wp-config.php). Exploitation requires at least one File-type custom field published on the confirmation page.

Original NVD description (English source)

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS