CVE-2026-15918 is an unauthenticated SQL injection in VikAppointments, a WordPress service booking plugin. The injection point sits in an ORDER BY clause — a notorious exploitation target precisely because column names cannot be parameterized in standard prepared statements, forcing developers toward direct string concatenation or custom mapping layers. This is not a developer competence failure; it's a tooling design problem where the safe approach requires more boilerplate than the unsafe one, and the WordPress plugin ecosystem provides no security scaffold to change that calculus.
The CVSS 7.5 rating undersells this vulnerability for three compounding reasons. First, it's unauthenticated — the attack surface is the public booking page, not a hardened admin panel. Second, it's production-facing — this is a live booking system processing customer transactions, not a dormant utility. Third, and most critically, the target is wp_users. Extracting admin password hashes and cracking them provides direct CMS admin access, which in WordPress unlocks theme editor, plugin installation, and wp-config.php reads — a pivot path so established it has its own WPScan database. CVSS treats the database as a single asset; in practice, wp_users is a transit hub to full site compromise.
The exploitation mechanism matters for defenders relying on WAFs. Standard SQLi detection looks for quotes, comments, and stacked queries — all absent in ORDER BY injection. The reliable attack path is blind extraction using CASE expressions: ORDER BY (SELECT CASE WHEN [condition] THEN 3 ELSE 4 END). This generates no anomalous traffic pattern. If you're depending on a WAF rule covering classic SQLi patterns, audit it against blind extraction in ORDER BY clauses before assuming you're protected.
The EPSS of 0.00388 is a lagging indicator. For a WordPress plugin with thousands of installations and a predictable disclosure-to-PoC timeline (typically 2-4 weeks), that probability jumps to near-certainty once public exploitation drops. The real exposure window isn't patch-to-exploit — it's patch-to-deployment across thousands of sites with no centralized update mechanism. WordPress plugin auto-updates are disabled by default on most hosting platforms, meaning remediation velocity is structurally slow regardless of how quickly the vendor releases a patch.
Check whether your VikAppointments installation is exposed. If you're on an unpatched version, assume compromise already happened and rotate all WordPress admin credentials immediately — not after you finish investigating.