CVE-2026-87115

Name of the Vulnerable Software and Affected Versions VikAppointments Services Booking Calendar versions prior to 1.2.22

Description Insufficient file path validation in the extract() function allows unauthenticated attackers to delete arbitrary files on the server. This issue can lead to remote code execution if critical files, such as wp-config.php, are deleted. Exploitation is possible provided that at least one File-type custom field is published on the confirmation page shortcode, as this configuration is not active by default.

Recommendations Update to a version newer than 1.2.21.