Junglewise Threat Intelligence

CVE-2026-12111: CodePeople Appointment Booking Calendar sensitive information exposure

CVE-2026-12111 · Severity: medium · CVSS 4.3 · Published 2026-06-18

Technologies: CodePeople Appointment Booking Calendar. Vendors: CodePeople.

Executive brief

The Appointment Booking Calendar plugin for WordPress, used to manage schedules and customer reservations, contains a security flaw that allows unauthorized access to booking data. An attacker with basic contributor-level access to the website can view sensitive customer information, including names, email addresses, phone numbers, and private comments. This could lead to privacy violations and the exposure of personal data for all customers using the booking system.

Technical details

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function. The function is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only verifies if a user has 'edit_posts' capabilities (Contributor-level and above). Authenticated attackers can supply an arbitrary calendar ID via the 'id' parameter to extract customer booking information, including email addresses, names, phone numbers, booking times, and comments. A patch appears to be available in newer versions based on the provided changeset references.

Affected products

  • CodePeople Appointment Booking Calendar up to, and including, 1.4.01

Timeline

  • 2026-06-18: advisory: Original advisory published by Wordfence and NVD.

References

Related threats