# VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Sensitive Information Exposure via U-tec Webhook Debug Log

- **ID:** WPSEC-2026-1433
- **Plugin:** VikBooking Hotel Booking Engine & PMS (`vikbooking`), https://wordpress.org/plugins/vikbooking/
- **Affected versions:** from 1.8.7 before 1.8.18
- **Fixed in:** 1.8.18 (Update to 1.8.18 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-532
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vikbooking
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1433/

## Description

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the U-tec door access webhook endpoint in versions 1.8.7 up to, and including, 1.8.17, due to the U-tec webhook handler writing the raw request body, request parameters and server variables to a webhook_debug.txt file inside the plugin directory, where the web server can serve it. The public apps.webhook endpoint also accepted any door access profile ID for the U-tec provider. This makes it possible for unauthenticated attackers to read the logged webhook data, including requests that U-tec sent to the site, and server environment details from that file, provided at least one door access control profile is configured.

## References

- https://wpsec.com/vuln/WPSEC-2026-1433/
- https://plugins.svn.wordpress.org/vikbooking/tags/1.8.18/
- https://wordpress.org/plugins/vikbooking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1433/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.