VikAppointments Services Booking Calendar: Unauthenticated arbitrary file deletion

Summary

The VikAppointments Services Booking Calendar WordPress plugin contains an insufficient file path validation flaw in its extract function. An unauthenticated attacker can delete arbitrary files on the server, for example wp-config.php, which can lead to Remote Code Execution. Exploitation requires at least one File-type custom field published on the confirmation page shortcode, which is not created by default.

Affected

• VikAppointments Services Booking Calendar WordPress plugin, all versions up to and including 1.2.21
• Unknown whether 1.2.22 is affected: one third-party page lists it as affected, which conflicts with the vendor changelog

Fixed in

• Version 1.2.22 (according to the vendor changelog and advisory PT-2026-104544)

Workaround

• Vendor-confirmed workarounds: none found.
• Not a vendor recommendation: check the confirmation page shortcode and remove File-type custom fields from it to reduce exposure.

Exploitation

• CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial
• Not listed in CISA KEV
• No public proof of concept confirmed
• EPSS about 0.9 percent
• In-the-wild exploitation: unknown

Our recommendation

• Update the plugin to version 1.2.22 or later on all sites and verify the installed version afterwards.
• Check whether a File-type custom field is published on a confirmation page; if so, remove it until the update is applied.
• Create a full backup before updating.
• Monitor for unexpected missing core or configuration files, and review the plugin's exposure on internet-facing booking sites.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• PT-2026-104544 advisory (PT Security) vulners.com
• WordPress plugin listing: VikAppointments wordpress.org
• Wordfence threat intelligence record www.wordfence.com
• Trac changeset 3721264 (VikAppointments) plugins.trac.wordpress.org
• Rapid7 vulnerability record via Vulners vulners.com
• Strix CVE record CVE-2026-87115 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:36.