CVE-2025-64261
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.
Risk Assessment
Unauthorized users may gain access to booking calendar functionality, potentially leading to manipulation of bookings or leakage of customer data.
Recommendation
Update the plugin to a patched version. Review permissions and ensure only authorized users have access to booking management.
Other vulnerabilities in Appointment Booking Calendar
See all- CVE-2026-13358Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.
- CVE-2026-12113Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.4.02 exposes sensitive information via the cpabc_appointments_filter_list parameter. This allows authenticated attackers with contributor-level access or higher to extract customer personal identifiable information such as names, email addresses, phone numbers, appointment comments, and other booking details.
Original NVD description (English source)
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS