4.3
MediumCVSS 3.1 · from Wordfence
CVE-2026-12113
Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
Appointment Booking Calendar · Missing authorization · CWE-862AffectedAppointment Booking Calendar
FixNo fix listed yet.
PublishedJul 1, 04:32 · Wordfence
ScoredJul 1 · 4.3 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.
From Wordfence
Affected and fixed versions
ProductAffectedFixed inAppointment Booking Calendarup to 1.4.02–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known