CVE-2026-15918 describes an SQL injection vulnerability in the VikAppointments Services Booking Calendar WordPress plugin by e4jvikwp. The vulnerability occurs because a parameter from the incoming request, which controls how the public reviews list is sorted, is directly incorporated into a database query without proper neutralization of special SQL elements. This allows an unauthenticated attacker to inject arbitrary SQL commands via the normal booking page, potentially extracting sensitive information from the site's database, including WordPress user credentials. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks, enabling them to read sensitive data from the WordPress site's database. This includes potentially exposing WordPress user credentials and other confidential information. The vulnerability does not impact data integrity or availability directly but compromises confidentiality significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting access to the vulnerable plugin or applying custom input validation and sanitization on the affected parameter to mitigate exploitation risk.