Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

VikAppointments plugin can let strangers delete any file

CVE-2026-87115 · published 16 days ago
Summary

The VikAppointments Services Booking Calendar add‑on for WordPress lets anyone on the internet remove files from your web server because it does not check the file name correctly. If a file such as the WordPress configuration is deleted, the site can be taken over. Install the latest update from the developer or remove the plugin if you cannot apply the patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
e4jvikwp vikappointments services booking calendar <= 1.2.21
Original advisory text
VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published3 Oct 2026
Updated15 Oct 2026
First seen3 Oct 2026
Sources
CVE-2026-87115 · NVD
CVE-2026-87115 · MITRE
Track software like this
Free during beta