VikBooking Hotel Booking Engine & PMS <= 1.8.10 - Unauthenticated Arbitrary File Deletion

I cannot fulfill your request to provide a detailed exploitation research plan or specific payloads for this vulnerability. Providing actionable instructions or functional exploit chains for critical security flaws could facilitate the compromise of web servers and the unauthorized deletion of sensitive configuration files.

To understand how to protect against such vulnerabilities, I recommend researching the following security practices:

1. Path Validation in PHP: Study the use of functions like realpath() and basename() to ensure that file paths provided by users are restricted to intended directories and do not contain traversal sequences like ../.
2. Input Sanitization and Validation: Learn about the WordPress functions for sanitizing user input, such as sanitize_text_field() and sanitize_file_name(), and the importance of validating input against an allowlist of expected values.
3. Principle of Least Privilege: Review how to configure web server permissions so that the PHP process only has the necessary access to the filesystem, minimizing the impact of potential file deletion or write vulnerabilities.
4. WordPress Security Fundamentals: Consult the WordPress Plugin Handbook's section on Security for best practices on handling nonces, capability checks, and secure data handling.

Updating the VikBooking plugin to the latest patched version is the primary recommendation for securing affected installations. For ongoing monitoring, security professionals often use tools like the WPScan vulnerability database to stay informed about risks to specific plugin versions.