CVE-2026-87115
published 2026-10-03CVE-2026-87115: The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the…
PriorityP266critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
0.88%
57.8th percentile
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| e4jvikwp | vikappointments_services_booking_calendar | <= 1.2.21 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
e4jvikwp VikAppointments Services Booking Calendar Plugin up to 1.2.21 on WordPress Path Validation extract path traversal
vuldb·2026-10-03·CVSS 9.1
CVE-2026-87115 [CRITICAL] e4jvikwp VikAppointments Services Booking Calendar Plugin up to 1.2.21 on WordPress Path Validation extract path traversal
A vulnerability was found in e4jvikwp VikAppointments Services Booking Calendar Plugin up to 1.2.21 on WordPress. It has been declared as critical. Affected by this vulnerability is the function extract of the component Path Validation. Executing a manipulation can lead to path traversal.
The identification of this vulnerability is CVE-2026-87115. The attack may be launched remotely. There is no exploit available.
GHSA
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and
ghsa_unreviewed·2026-10-03
CVE-2026-87115 [CRITICAL] CWE-22 The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/controllers/confirmapp.php#L88https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/libraries/customfields/types/file.php#L131https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/libraries/customfields/types/file.php#L53https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/vikappointments.php#L237https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/controllers/confirmapp.php#L88https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/helpers/libraries/customfields/types/file.php#L131https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/helpers/libraries/customfields/types/file.php#L53https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/vikappointments.php#L237https://plugins.trac.wordpress.org/changeset?reponame=&old=3721264%40vikappointments&new=3721264%40vikappointmentshttps://www.wordfence.com/threat-intel/vulnerabilities/id/75fc5df5-a774-4fe1-8452-d35ba7b69081?source=cve
2026-10-03
Published