Description
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Published: 2026-10-03
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via arbitrary file deletion
Action: Immediate Patch
AI Analysis

Impact

Unauthenticated attackers can delete any file on the server due to missing validation of the file path in the extraction function. The vulnerability allows deletion of critical files such as wp-config.php, which can lead to remote code execution. The CVSS score of 9.1 reflects the high confidentiality, integrity, and availability impact of this flaw.

Affected Systems

The affected product is the VikAppointments Services Booking Calendar plugin for WordPress, version 1.2.21 and earlier. All installations using these versions are vulnerable, regardless of the WordPress core or other plugins in use.

Risk and Exploitability

The flaw can be exploited by sending a crafted HTTP request that includes the old_vapcfN parameter pointing to a target file. The attacker does not need any credentials and only requires the presence of a file‑type custom field on the confirmation page. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the CVSS rating indicates that successful exploitation would be catastrophic and could affect an entire site.

Generated by OpenCVE AI on October 3, 2026 at 08:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the VikAppointments Services Booking Calendar plugin to a version newer than 1.2.21.
  • If an immediate update is not possible, remove or disable any file‑type custom fields from the confirmation page shortcode to block the deletion vector.
  • Regularly audit server logs for unexpected file deletion attempts and maintain current backups to enable swift recovery.

Generated by OpenCVE AI on October 3, 2026 at 08:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 03 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 03 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Description The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
Title VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-03T15:42:42.039Z

Reserved: 2026-09-08T20:45:54.127Z

Link: CVE-2026-87115

cve-icon Vulnrichment

Updated: 2026-10-03T15:38:47.867Z

cve-icon NVD

Status : Received

Published: 2026-10-03T07:16:48.347

Modified: 2026-10-03T16:16:40.057

Link: CVE-2026-87115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-03T09:00:13Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')