CVE-2026-87115

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.

• CWE-22

• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/controllers/confirmapp.php#L88
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/libraries/customfields/types/file.php#L131
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/site/helpers/libraries/customfields/types/file.php#L53
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.19/vikappointments.php#L237
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/controllers/confirmapp.php#L88
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/helpers/libraries/customfields/types/file.php#L131
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/site/helpers/libraries/customfields/types/file.php#L53
• https://plugins.trac.wordpress.org/browser/vikappointments/tags/1.2.21/vikappointments.php#L237
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3721264%40vikappointments&new=3721264%40vikappointments
• https://www.wordfence.com/threat-intel/vulnerabilities/id/75fc5df5-a774-4fe1-8452-d35ba7b69081?source=cve

Published

Oct 3, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87109An authenticated Ops Manager organization member can retriev…6.5
• CVE-2026-8711NGINX JavaScript has a vulnerability when the js_fetch_proxy…9.8
• CVE-2026-87110An unauthenticated user with network access to the Ops Manag…5.3
• CVE-2026-87111The User Registration PRO – Custom Registration Form, Login …7.2
• CVE-2026-87113Tanium addressed an improper access controls vulnerability i…6.3
• CVE-2026-87114A flaw was found in kube-compare. When processing a 'contain…7.1
• CVE-2026-87116Tanium addressed a server-side request forgery vulnerability…6.5
• CVE-2026-87117NULL pointer dereference vulnerability in Apache Thrift PHP …8.7
• CVE-2026-87118The Botslab G980H dash camera firmware contains an out of bo…5.7
• CVE-2026-87119Authentication Bypass by Capture-replay in ZenHive mpp allow…8.2
• CVE-2026-8712Wyoming before 1.10.2 contains a server-side request forgery…8.3
• CVE-2026-87121lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds wri…9.8