CVE-2026-18496

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 11.4.4

Description The Booking Calendar plugin for WordPress contains a flaw that allows unauthenticated attackers to extract sensitive customer data, such as names, email addresses, and phone numbers of individuals who have made bookings. This occurs through the wpbc is show popover in flex timeline() function.

Recommendations Update the plugin to version 11.4.4 or later. As a temporary workaround, consider restricting access to the wpbc is show popover in flex timeline() function until the update is applied.