Description

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-03T17:17:28.010Z",
  "pubdate": "2026-09-03T17:17:28.010Z",
  "executiveSummary": "The VikAppointments Services Booking Calendar plugin for WordPress, in versions up to and including 1.2.20, is susceptible to an unauthenticated SQL injection vulnerability.\nThis security flaw allows remote, unauthenticated attackers to execute arbitrary SQL queries against the underlying database without requiring administrative privileges or authentication.\nThe vulnerability resides in the application's failure to properly sanitize or parameterize user-supplied input before incorporating it into database queries.\nSuccessful exploitation can lead to unauthorized access to sensitive data, including user credentials, booking history, and configuration details.\nFurthermore, depending on the database configuration and permissions, an attacker could potentially modify, delete, or exfiltrate the entire contents of the WordPress database, resulting in a full system compromise.\nThe vulnerability is exposed to the public internet, requiring no special interaction or valid user session to initiate an attack, posing a high risk to the confidentiality, integrity, and availability of the affected WordPress site.",
  "technicalDetails": "The vulnerability is classified as an Unauthenticated SQL Injection (SQLi), stemming from improper input validation within the VikAppointments plugin's query construction process.\nThe issue occurs because user-supplied input, typically passed through HTTP request parameters, is directly concatenated into SQL statements executed by the plugin against the MySQL database.\nBy crafting a malicious HTTP GET or POST request containing specially formatted SQL syntax, an attacker can manipulate the query logic to bypass security checks, extract data from other tables, or perform administrative operations.\nThe attack flow begins with the discovery of an entry point within the plugin's service booking or calendar functions where parameter input is not subjected to strict typing or prepared statements.\nAn attacker initiates a request to the vulnerable endpoint, injecting SQL tokens such as 'UNION SELECT', 'OR 1=1', or blind-based inference patterns into parameters.\nBecause the application logic does not utilize parameterized queries or binding, the database engine interprets the injected strings as executable code rather than literal input.\nThis allows the execution of arbitrary commands, facilitating data exfiltration via error-based, union-based, or time-based blind SQL injection techniques.\nGiven that the WordPress environment often uses a single database user with sufficient privileges to manage all tables, the impact extends beyond the plugin data to the entire site, including wp_users tables, which stores hashed authentication credentials.\nPost-exploitation, an attacker can extract session tokens, elevate their own account privileges to administrator, or dump configuration data containing sensitive API keys or environmental variables.\nThe flaw affects all versions of VikAppointments Services Booking Calendar up to and including 1.2.20, effectively impacting every installation that has not implemented external WAF protection or updated to a patched version."
}