Executive Summary

This vulnerability, identified as CVE-2026-42737, affects the VikBooking Hotel Booking Engine & PMS WordPress plugin versions 1.8.9 and below. It is a Path Traversal issue that allows unauthenticated attackers to delete arbitrary files from the website. This flaw falls under the OWASP Top 10 category A1: Broken Access Control, meaning attackers can bypass restrictions to access or modify files they should not be able to.

The vulnerability has a high severity score of 8.6, indicating it is dangerous and can be exploited widely.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to delete files from the website, which can lead to site breakage or malfunction.

Such unauthorized file deletion and potential disruption of service could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity and availability.

Specifically, the vulnerability falls under OWASP Top 10's A1: Broken Access Control category, indicating a failure to properly restrict access, which is critical for maintaining compliance with data protection regulations.

Organizations using the affected plugin should update to the patched version 1.8.10 or apply mitigation measures to reduce risk and maintain compliance.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows attackers to delete files on the affected website without authentication. This can lead to site breakage or malfunction, potentially causing downtime, loss of data, or disruption of services provided by the website.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability allows unauthenticated attackers to delete files via a path traversal flaw in the VikBooking Hotel Booking Engine & PMS plugin. Detection involves monitoring for suspicious HTTP requests attempting to exploit path traversal or arbitrary file deletion.

You can detect potential exploitation attempts by inspecting web server logs for unusual URL patterns containing directory traversal sequences such as "../" or encoded variants.

Example commands to search for such patterns in Apache or Nginx access logs:

• grep -iE "\.\./|%2e%2e" /var/log/apache2/access.log
• grep -iE "\.\./|%2e%2e" /var/log/nginx/access.log

Additionally, monitoring for unexpected file deletions or errors related to missing files in the website directory may indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation is to update the VikBooking Hotel Booking Engine & PMS plugin to version 1.8.10 or later, where this vulnerability is patched.

Until the update can be applied, it is advised to implement the mitigation rule provided by Patchstack to block attacks exploiting this vulnerability.

You may also seek assistance from your hosting provider or developer to apply temporary protections such as web application firewall (WAF) rules blocking path traversal attempts.

Useful 0 Not Useful 0