CVE-2026-12111

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function, which is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only checks is_admin() && current_user_can('edit_posts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.

• CWE-200

• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.99/cpabc_appointments.php#L142
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.99/inc/cpabc_apps_go.inc.php#L1018
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.99/inc/cpabc_apps_go.inc.php#L1019
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.99/inc/cpabc_apps_go.inc.php#L945
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/trunk/cpabc_appointments.php#L142
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/trunk/inc/cpabc_apps_go.inc.php#L1018
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/trunk/inc/cpabc_apps_go.inc.php#L1019
• https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/trunk/inc/cpabc_apps_go.inc.php#L945
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3570448%40appointment-booking-calendar&new=3570448%40appointment-booking-calendar&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ecc237-87b0-4c4d-94cc-d3af9c6669c5?source=cve

Published

Jun 18, 2026

Last Modified

Jun 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12102The UsersWP – Front-end login form, User Registration, User …2.7
• CVE-2026-12103The Wallet for WooCommerce plugin for WordPress is vulnerabl…4.3
• CVE-2026-12104OS command injection in the environment and tunnel configura…8.6
• CVE-2026-12105Improper access control in Devolutions Server 2026.2.5, 2026…6.5
• CVE-2026-12108The Highlighting Code Block plugin for WordPress is vulnerab…4.4
• CVE-2026-12110The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-12112A flaw was found in the foreman-mcp-server. A session manage…7.8
• CVE-2026-12113The Appointment Booking Calendar plugin for WordPress is vul…4.3
• CVE-2026-12114The Team Members – Multi Language Supported Team Plugin plug…4.4
• CVE-2026-12115The Counter Box – Add Countdowns, Timers & Dynamic Counters …6.6
• CVE-2026-12116A vulnerability in the Xerte Online Tools allows for RCE thr…9.8
• CVE-2026-12117Improper access control in the social login connection endpo…4.3