CVE-2026-103915

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions prior to 2.4.13

Description Unauthenticated attackers can extract personally identifiable information of staff members, including full names, email addresses, phone numbers, gender, and timezones. Additionally, internal notes authored by administrators for every published event can be retrieved. This occurs because the raw providers array is not stripped before being serialized into the JSON response via the page parameter.

Recommendations Update the plugin to version 2.4.13 or later. Avoid using the page parameter in the affected plugin until the update is applied.