CVE-2026-15918

Name of the Vulnerable Software and Affected Versions VikAppointments Service Booking Calendar (affected versions not specified)

Description An unauthenticated SQL injection exists because a parameter controlling the sorting of the public reviews list is used to construct a database query without proper validation or sanitization. This allows an attacker to inject arbitrary SQL through a booking page to read sensitive data from the database, such as WordPress user credentials. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to database information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.