Is CVE-2026-12111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12111 being exploited in the wild.

How severe is CVE-2026-12111?

Medium severity, with a CVSS score of 4.3, published 18 June 2026.

Which products and versions are affected?

CodePeople Appointment Booking Calendar up to, and including, 1.4.01.

Is there a fix for CVE-2026-12111?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12111 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12111?

Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12111: CodePeople Appointment Booking Calendar sensitive information exposure

CVE-2026-12111 · Severity: medium · CVSS 4.3 · Published 2026-06-18

The Appointment Booking Calendar plugin for WordPress, used to manage schedules and customer reservations, contains a security flaw that allows unauthorized access to booking data. An attacker with basic contributor-level access to the website can view sensitive customer information, including names, email addresses, phone numbers, and private comments. This could lead to privacy violations and the exposure of personal data for all customers using the booking system.

Technologies: CodePeople Appointment Booking Calendar. Vendors: CodePeople.

Quick answers

Is CVE-2026-12111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12111 being exploited in the wild.
How severe is CVE-2026-12111?: Medium severity, with a CVSS score of 4.3, published 18 June 2026.
Which products and versions are affected?: CodePeople Appointment Booking Calendar up to, and including, 1.4.01.
Is there a fix for CVE-2026-12111?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12111 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12111?: Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function. The function is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only verifies if a user has 'edit_posts' capabilities (Contributor-level and above). Authenticated attackers can supply an arbitrary calendar ID via the 'id' parameter to extract customer booking information, including email addresses, names, phone numbers, booking times, and comments. A patch appears to be available in newer versions based on the provided changeset references.

Affected products

CodePeople Appointment Booking Calendar up to, and including, 1.4.01

Timeline

2026-06-18: advisory: Original advisory published by Wordfence and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.