CVE-2026-87115 e4jvikwp CVE debrief

Who should care

Defenders responsible for WordPress deployments using the VikAppointments Services Booking Calendar plugin should assess exposure and prioritize verification of File-type custom fields on confirmation pages.

Why it matters

CVE-2026-87115 is a critical vulnerability in the VikAppointments Services Booking Calendar plugin for WordPress, allowing unauthenticated attackers to delete arbitrary files, potentially leading to remote code execution. Defenders should prioritize verification of File-type custom fields on confirmation pages and restrict access to sensitive files.

• Unauthenticated attackers can delete arbitrary files on the server.
• Deletion of sensitive files can lead to remote code execution.
• Defenders must verify the presence of File-type custom fields on confirmation pages.
• Plugin version verification and updates are necessary.

Technical summary

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted, such as wp-config.php. Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation. Defenders should prioritize verifying the presence of File-type custom fields on confirmation pages and restrict access to such

Defensive priority

Defenders should prioritize verifying the presence of File-type custom fields on confirmation pages and restrict access to sensitive files.

Recommended defensive actions

• Verify the presence of File-type custom fields on confirmation pages and restrict access to sensitive files.
• Implement additional monitoring to detect potential exploitation attempts.
• Review and update the plugin to the latest version if possible.
• Perform a thorough review of the plugin's codebase to identify potential vulnerabilities.
• Conduct a risk assessment to determine the potential impact of the vulnerability on the organization.
• Develop a plan to implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including the affected plugin and versions. However, the exact scope of affected deployments and potential exploitation attempts remain unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.