Appointment Booking Calendar vulnerabilities

The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.

The Appointment Booking Calendar plugin for WordPress up to version 1.4.02 exposes sensitive information via the cpabc_appointments_filter_list parameter. This allows authenticated attackers with contributor-level access or higher to extract customer personal identifiable information such as names, email addresses, phone numbers, appointment comments, and other booking details.

The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.