High · 7.4 CVE-2026-57723 EUVD-2026-41097GHSA-c847-9rm9-gc74

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal.

This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.

Vendor	Product	Affected	Fixed
e4jvikwp	VikBooking Hotel Booking Engine & PMS	≤ 1.8.12	—