CVE-2026-12111

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar versions prior to 1.4.02

Description The plugin is subject to sensitive information exposure due to insufficient authorization and a lack of per-calendar ownership verification within the cpabc appointments calendar load2() function. This function is accessible via the cpabc calendar load2=1 query parameter in 'wp-admin'. The system only verifies if the user is an administrator or has the edit posts capability, which is granted to users with Contributor-level access and above. Consequently, authenticated attackers with these privileges can provide an arbitrary calendar ID through the id parameter to extract customer booking data, such as names, email addresses, phone numbers, booking times, and comments, from any calendar managed by the plugin.

Recommendations Update the plugin to a version later than 1.4.01. As a temporary workaround, restrict access to the cpabc appointments calendar load2() function or the id parameter in the 'wp-admin' area for users with Contributor-level privileges.