CVE-2022-27862: Vikwp Vikbooking Hotel Booking Engine & Property Management System Plugin

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.

Affected products

• Vikwp Vikbooking Hotel Booking Engine & Property Management System Plugin: up to and including 1.5.3

Published 2022-04-19. Last modified 2026-06-17.