Sensitive Information Exposure in Appointment Booking Calendar Plugin for WordPress

CVE-2026-12111

What is CVE-2026-12111?

The Appointment Booking Calendar plugin for WordPress is susceptible to a sensitive information exposure vulnerability that allows authenticated attackers with Contributor-level access or above to exploit insufficient authorization measures. Specifically, the weakness arises from missing per-calendar ownership checks within the cpabc_appointments_calendar_load2() function. By leveraging the cpabc_calendar_load2=1 query parameter, attackers can insert an arbitrary calendar ID and retrieve sensitive customer booking information such as email addresses, names, phone numbers, booking times, and comments from any calendars handled by this plugin.

References