CVE-2026-12113

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar versions prior to 1.4.03

Description The Appointment Booking Calendar plugin for WordPress contains a sensitive information exposure flaw. Authenticated users with contributor-level access or higher can extract personally identifiable information, including customer names, email addresses, phone numbers, and appointment comments, through the cpabc appointments filter list function.

Recommendations Update the plugin to a version later than 1.4.02. As a temporary mitigation, restrict access to the cpabc appointments filter list function for users with contributor-level permissions.