CVE-2026-15918 is an SQL injection vulnerability in the VikAppointments Services Booking Calendar WordPress plugin by e4jvikwp. The vulnerability occurs because a parameter from the incoming request, which controls the sorting of the public reviews list, is directly embedded into a SQL query without adequate input validation or sanitization. This allows an unauthenticated attacker to inject arbitrary SQL commands via the normal booking page, potentially reading sensitive information such as WordPress user credentials from the database. No authentication or special privileges are required for exploitation. The CVSS 3.1 base score is 7.5 (High), with attack vector Network, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

An unauthenticated attacker can exploit this vulnerability to read sensitive data from the WordPress site's database, including user credentials. This compromises the confidentiality of the affected system's data. There is no impact on integrity or availability reported. The vulnerability allows data disclosure without requiring authentication or special privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Until a patch is available, restrict access to the booking page if possible or monitor for suspicious activity related to SQL injection attempts.