What is CVE-2026-15918?
The VikAppointments Service Booking Calendar WordPress plugin contains an unauthenticated SQL injection vulnerability due to insufficient validation of a parameter used for sorting public reviews. This allows attackers to execute unauthorized database queries. Immediate plugin update is recommended.
Azərbaycanca: VikAppointments Service Booking Calendar WordPress plaqini rəylərin sıralanması parametrini düzgün yoxlamadığı üçün "unauthenticated SQL injection" zəifliyinə məruz qalır. Bu, istənilən şəxsə verilənlər bazasına icazəsiz sorğular göndərməyə imkan verir. Plaqini dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-89
FAQ1
Does exploiting CVE-2026-15918 require authentication?
No, this is an unauthenticated SQL injection vulnerability. The VikAppointments plugin fails to properly validate a parameter used for sorting public reviews, allowing anyone to send unauthorized database queries without logging in.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.