CVE-2026-87115
CriticalCVSS 9.1Summary
The VikAppointments Services Booking Calendar plugin for WordPress up to version 1.2.21 is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution (e.g., by deleting wp-config.php). Exploitation requires at least one File-type custom field published on the confirmation page.
Risk Assessment
An attacker can delete critical server files, potentially leading to full site compromise or denial of service.
Recommendation
Immediately update the VikAppointments plugin to the latest patched version. Also, review confirmation pages for any File-type custom fields and remove them if not essential.
Other vulnerabilities in VikAppointments Services Booking Calendar
Original NVD description (English source)
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS