The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to submit a crafted request to the VikBooking Hotel Booking Engine & PMS plugin. The request exploits a path traversal weakness, enabling the deletion of arbitrary files on the hosting server. Loss of files compromises the integrity of the application, can interrupt the booking system’s availability, and may expose or remove sensitive data, potentially affecting confidentiality as well. The weakness is classified as CWE‑352.

Any WordPress site that has installed the VikBooking plugin version 1.8.12 or earlier is affected. The vendor states the flaw exists from "n/a" through 1.8.12, meaning every release up to that point contains the issue. Updating to 1.8.13 or later removes the CSRF and path traversal flaw.

The CVSS score of 7.4 reflects a high severity for this vulnerability. The EPSS score of less than 1 % indicates a relatively low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Because the flaw is a CSRF defect, an attacker would need to convince an authenticated or privileged user to visit a malicious URL that triggers the deletion request. The vendor documentation does not explicitly describe permission checks or use of a defensive token, so it is inferred that the deletion could succeed without additional verification. The combination of a CSRF trigger and path traversal means that once the request is sent, the attacker can target any file within the server’s directory structure that the web process can write to.