CVE-2026-15918: VikAppointments WordPress Plugin SQLi Flaw

CVE-2026-15918 Overview

CVE-2026-15918 is an unauthenticated SQL injection vulnerability in the VikAppointments Service Booking Calendar plugin for WordPress. The flaw resides in the sort parameter used by the public reviews list on booking pages. The plugin passes this request-supplied value directly into a database query without validation or sanitization.

An unauthenticated attacker can inject arbitrary SQL through a normal booking page. Successful exploitation allows reading arbitrary data from the WordPress database, including user credentials. No authentication, user interaction, or special privileges are required to trigger the vulnerability.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including WordPress user credential hashes, from any site running a vulnerable version of the VikAppointments plugin.

Affected Products

VikAppointments Service Booking Calendar WordPress plugin (through version 1.2.19)
WordPress sites exposing the public reviews list via the employeesearch view
WordPress sites exposing the public reviews list via the servicesearch view

Discovery Timeline

2026-08-05 - CVE-2026-15918 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15918

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] triggered through a sort parameter that governs how the plugin renders its public reviews list. Attackers reach the vulnerable code path by requesting a booking page that invokes the employeesearch or servicesearch view. Because the reviews list is public, no session, cookie, or account is required to reach the sink.

The plugin reads the sort value from the incoming HTTP request and concatenates it into a SQL statement built inside lib.vikappointments.php. The sink is reached via view controllers at site/views/employeesearch/view.html.php and site/views/servicesearch/view.html.php. Order-by clauses cannot be parameterized with standard prepared statements, so the developer must maintain an allow-list of sortable columns — this control is missing.

Root Cause

User-controlled input is placed directly into the ORDER BY portion of a database query without validation, sanitization, or an allow-list check. The absence of column whitelisting on sort parameters is a recurring source of injection in PHP applications and is documented in the referenced WordPress Plugin Code Snippet.

Attack Vector

An attacker sends a crafted HTTP request to a public booking page and supplies a malicious value in the sort parameter consumed by the reviews list. The injected SQL is executed with the privileges of the WordPress database user, permitting UNION-based or time-based extraction of arbitrary tables. Full technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-15918

Indicators of Compromise

HTTP requests to employeesearch or servicesearch endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA in sort-related parameters.
Unusually long or URL-encoded values in ordering parameters submitted to VikAppointments booking pages.
Web server logs showing repeated requests to booking pages from a single IP with iterating payload variations, indicative of automated SQLi tooling.
Database error entries referencing wp_users or the plugin's tables originating from the reviews-list query path.

Detection Strategies

Deploy WAF rules that inspect query strings on VikAppointments booking endpoints for SQL metacharacters and ORDER BY manipulation patterns.
Enable MySQL general or slow query logging temporarily to correlate anomalous queries with request timestamps in access logs.
Alert on any HTTP response from booking pages that includes SQL error strings such as You have an error in your SQL syntax.

Monitoring Recommendations

Monitor outbound egress from the web server for unexpected exfiltration following spikes in booking-page traffic.
Track authentication failures and password reset requests for WordPress administrator accounts after suspicious plugin activity.
Baseline normal request volumes to index.php?option=com_vikappointments and alert on statistically significant deviations.

How to Mitigate CVE-2026-15918

Immediate Actions Required

Update the VikAppointments Service Booking Calendar plugin to the latest patched release published after version 1.2.19.
If a patch is not yet available or cannot be applied immediately, disable the VikAppointments plugin from the WordPress admin interface.
Rotate all WordPress user passwords and any secrets stored in the database, assuming credential exposure until logs confirm otherwise.
Review web server and database logs for evidence of exploitation dating back to plugin installation.

Patch Information

Upgrade to a fixed version of the VikAppointments plugin newer than 1.2.19. Vulnerable code paths are documented at the referenced plugin source at line 5907 and line 6011. Consult the Wordfence Vulnerability Report for fixed-version details.

Workarounds

Deploy a WAF virtual patch that blocks SQL metacharacters in ORDER BY-related parameters submitted to VikAppointments views.
Restrict access to the booking pages by IP allow-list where feasible until the plugin is updated.
Grant the WordPress database user only the minimum privileges required, limiting the scope of data an attacker can extract.

bash

# Example ModSecurity rule to block SQLi payloads on VikAppointments endpoints
SecRule REQUEST_URI "@rx (employeesearch|servicesearch)" \
  "chain,id:1015918,phase:2,deny,status:403,log,msg:'Potential CVE-2026-15918 SQLi'"
  SecRule ARGS "@rx (?i)(union[\s/*]+select|sleep\s*\(|benchmark\s*\(|information_schema)" \
    "t:none,t:urlDecodeUni"