VikAppointments public review sorting permits SQL injection
VikAppointments Services Booking Calendar through 1.2.19 uses an unauthenticated request value that controls the sort order of a public reviews list when constructing a database query without adequate validation or parameterization. An attacker can inject SQL through a normal public booking page and use time-based or other database behavior to extract sensitive WordPress data, including credential material. The CNA record points to the review-query and public search-view code but does not disclose the request parameter's name.
- Component
- VikAppointments Services Booking Calendar
- Plugin slug
vikappointments- Affected
- <= 1.2.19
- Safe version
> 1.2.19- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update VikAppointments Services Booking Calendar to a release after 1.2.19. The authoritative record establishes the affected boundary but does not name the first fixed version. Review public booking requests and database activity if a vulnerable release was reachable.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N