CVE-2026-12113 MEDIUM

CVE-2026-12113: Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure

Vendor Codepeople

Product Appointment Booking Calendar

Weakness CWE-862 · Missing authorization

Published July 1, 2026

Last update July 1, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.

Key dates

02Disclosure timeline

July 1, 2026 CVE published

July 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-12113 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-4522 IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function CVE-2025-24596 WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability CVE-2023-47841 WordPress Analytify plugin <= 5.1.1 - Broken Access Control vulnerability CVE-2025-9194 Constructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean CVE-2021-24906 Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation