CVE-2026-12113
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Appointment Booking Calendar plugin for WordPress up to version 1.4.02 exposes sensitive information via the cpabc_appointments_filter_list parameter. This allows authenticated attackers with contributor-level access or higher to extract customer personal identifiable information such as names, email addresses, phone numbers, appointment comments, and other booking details.
Risk Assessment
The organization is at risk of leaking customer personal data, which may lead to violations of data protection regulations (e.g., GDPR), loss of customer trust, and potential legal and financial consequences.
Recommendation
Immediately update the Appointment Booking Calendar plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin or restrict access to the cpabc_appointments_filter_list function to trusted administrators only.
Other vulnerabilities in Appointment Booking Calendar
See all- CVE-2026-13358Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.
- CVE-2025-64261Medium
The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.
Original NVD description (English source)
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS