Executive brief
VikAppointments is a WordPress plugin that manages service bookings and appointment scheduling for small businesses. An attacker can exploit an unauthenticated SQL injection vulnerability in the public reviews list to extract sensitive data from the website's database, including WordPress user credentials and customer information, without needing to log in or have any special privileges.
Technical details
The vulnerability is an unauthenticated SQL injection (CWE-89) in the VikAppointments plugin's public reviews list sorting functionality. The plugin takes a sorting parameter directly from the incoming HTTP request and incorporates it into a database query without proper input validation or parameterized queries. An attacker can inject arbitrary SQL commands through the booking page's sort parameter to read unauthorized data from the WordPress database. The vulnerability requires only network access and no authentication, allowing trivial exploitation via standard HTTP requests.
Affected products
- VikAppointments Service Booking Calendar before 1.2.20
Timeline
- 2026-08-05: disclosed
- other: CVE-2026-15918 assigned