CVE-2026-15918 e4jvikwp CVE debrief

Who should care

WordPress site administrators using the VikAppointments Service Booking Calendar plugin, security teams monitoring for SQL injection vulnerabilities, and users with sensitive data in their WordPress databases should review and verify plugin versions, assess potential exposure, and implement mitigations or patches as necessary.

Technical summary

The VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to improper validation of user input used in database queries. An attacker can inject arbitrary SQL code through a normal booking page, potentially leading to sensitive data exposure, including WordPress user credentials. The vulnerability has a CVSS score of 7.5 and is considered High severity. The plugin does not properly sanitize or validate user input, allowing an attacker to inject malicious SQL code. This could lead to unauthorized access to sensitive data, including WordPress user credentials. Further review of plugin codebase and SQL injection techniques is required to fully understand the vulnerability.

Defensive priority

High priority due to high CVSS score and potential for sensitive data exposure.

Recommended defensive actions

• Inventory and verify VikAppointments Service Booking Calendar plugin version.
• Apply vendor patch or mitigate by restricting database access.
• Monitor for suspicious database queries.
• Implement additional security measures for WordPress user credentials.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection. Evidence is limited; further verification needed. Official CVE and NVD records confirm vulnerability existence. Wordfence security researchers provided details on vulnerable plugin code. Additional review of plugin codebase and SQL injection techniques is required to fully understand the vulnerability. Defenders should verify plugin version, review database access controls, and monitor for suspicious activity.

Official resources