External risk intelligence

VikAppointments Booking Calendar SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-84768

This vulnerability affects a booking calendar plugin, which is a public-facing web component by design. Such components are intended to be accessible to anonymous users over the internet to facilitate service scheduling, placing the vulnerable entry point directly on the public-facing edge of the web application.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in the VikAppointments Services Booking Calendar, a common plugin for managing appointments. This vulnerability, an SQL injection, allows unauthenticated attackers to potentially access or manipulate sensitive data stored within the booking system, which could impact business operations. The primary concern at this stage is confirming if this specific technology is in use and understanding the potential exposure.

Unauthenticated attackers can exploit data access.
Booking calendar use means direct public exposure.
Confirm relevance and assess potential business impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to the booking calendar feature. This could allow them to inject malicious SQL code, potentially leading to unauthorized access to sensitive data.

Accessible over the network.
SQL injection in booking calendar.
Leads to data exposure.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could exploit this vulnerability to inject malicious SQL commands. This could lead to unauthorized access and manipulation of the booking calendar's database, potentially impacting service availability.

Booking data and system integrity.
Via unauthenticated network requests.
Data exposure and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this unauthenticated SQL injection vulnerability, application owners and platform teams responsible for managing the VikAppointments plugin should initiate an asset inventory to identify all instances. Subsequently, these teams must confirm the exposure of these instances, assess business criticality, and identify the accountable owner before planning remediation based on the identified risk.

Application owners and platform teams.
Confirm plugin reachability and criticality.
Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VikAppointments Services Booking Calendar plugin?

VikAppointments is a software extension commonly installed on web platforms to manage scheduling. It provides the core functionality for users to book services, view availability, and interact with appointment calendars directly through a website interface.

How does this CVE-2026-84768 vulnerability work?

This flaw is classified as a SQL Injection (CWE-89). It occurs when the plugin fails to properly filter user input before using it in database queries. An attacker can supply malicious commands instead of expected data, tricking the system into revealing or altering sensitive information stored in the calendar's database.

Do I need to be logged in to trigger this bug?

No. The vulnerability is unauthenticated, meaning an attacker does not need a user account or special permissions to attempt the attack. It is triggered simply by sending specific, malicious network requests to the booking calendar component. Interactions that do not involve submitting input to the booking logic do not trigger this vulnerability.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal flags this as a high priority because the affected plugin is designed to be public-facing. Since it must accept scheduling requests from the internet to function, the vulnerable code is directly accessible to anyone browsing the web, putting the application's data at risk from global network traffic.

What should I do if I use this booking software?

Begin by inventorying your systems to locate all instances of the VikAppointments plugin. Once identified, confirm which instances are reachable from the internet, evaluate the criticality of the data they handle, and coordinate with your technical team to prioritize and apply security updates as they become available.

References

patchstack.com/database/wordpress/plugin/vikappointments/vulnerabili…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.