CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
e4jvikwp VikAppointments Services Booking Calendar
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.88%Chance of exploitation activity in the next 30 days, higher than 58% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Description
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Text from CVE List
Affected versions 1
- VikAppointments Services Booking Calendaraffected: all versions through 1.2.21CVE List
References 10
- wordfence.com/threat-intel/vulnerabilities/id/75fc5df5-a774-4fe1-8452-d35ba7b69081?source=cveReferencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/libraries/customfields/types/file.php#L53Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/libraries/customfields/types/file.php#L131Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/controllers/confirmapp.php#L88Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/vikappointments.php#L237Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/helpers/libraries/customfields/types/file.php#L131Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/helpers/libraries/customfields/types/file.php#L53Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/controllers/confirmapp.php#L88Referencevia CVE List
- plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/vikappointments.php#L237Referencevia CVE List
- plugins.trac.wordpress.org/changeset?reponame=&old=3721264%40vikappointments&new=3721264%40vikappointmentsReferencevia CVE List