WordPress Plugin Vulnerabilities

VikBooking Hotel Booking Engine & PMS < 1.8.11 - Unauthenticated Arbitrary File Deletion

Description

The plugin is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affects Plugins

Plugin icon
vikbooking
Fixed in 1.8.11

References

CVE
CVE-2026-42737
URL
https://vdp.patchstack.com/database/wordpress/plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-9-arbitrary-file-deletion-vulnerability

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
9.1 (critical)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
8e0f6af2-86e8-435f-9da2-617ccc3a9fa3

Timeline

Publicly Published
2026-05-27 (about 2 months ago)
Added
2026-06-02 (about 1 month ago)
Last Updated
2026-07-27 (about 15 hours ago)

Other

Published
Title
Published
2026-07-16
Title
Ninja Forms - Excel Export < 3.3.7 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
Published
2023-06-12
Title
ND Shortcodes < 7.0 - Subscriber+ LFI
Published
2024-03-26
Title
The Plus Addons for Elementor < 5.4.2 - Contributor+ LFI
Published
2025-04-17
Title
StoreContrl Woocommerce < 4.1.4 - Unauthenticated Arbitrary File Download
Published
2015-03-16
Title
MiwoFTP - File & Folder Manager <= 1.0.4 - Arbitrary File Disclosure