Is CVE-2026-12113 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12113 being exploited in the wild.

How severe is CVE-2026-12113?

Medium severity, with a CVSS score of 4.3, published 1 July 2026.

Which products and versions are affected?

CodePeople Appointment Booking Calendar up to, and including, 1.4.02.

Is there a fix for CVE-2026-12113?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12113 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12113?

Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12113: CodePeople Appointment Booking Calendar sensitive information exposure

CVE-2026-12113 · Severity: medium · CVSS 4.3 · Published 2026-07-01

The Appointment Booking Calendar plugin for WordPress, which manages customer scheduling and reservations, contains a security flaw that exposes sensitive information. An individual with basic contributor-level access to the website can view private customer details, including names, email addresses, phone numbers, and appointment comments. This could lead to the unauthorized disclosure of personally identifiable information (PII) and potential privacy violations for your customers.

Technologies: CodePeople Appointment Booking Calendar. Vendors: CodePeople.

Quick answers

Is CVE-2026-12113 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12113 being exploited in the wild.
How severe is CVE-2026-12113?: Medium severity, with a CVSS score of 4.3, published 1 July 2026.
Which products and versions are affected?: CodePeople Appointment Booking Calendar up to, and including, 1.4.02.
Is there a fix for CVE-2026-12113?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12113 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12113?: Check whether you run CodePeople Appointment Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Appointment Booking Calendar plugin for WordPress is vulnerable to sensitive information exposure due to missing authorization checks in the cpabc_appointments_filter_list function. The vulnerability is classified as CWE-862 (Missing Authorization). An authenticated attacker with at least contributor-level privileges can exploit this flaw via a network request to access the vulnerable component. Successful exploitation allows the attacker to extract sensitive booking data, including customer names, emails, phone numbers, and private comments. The issue affects all versions of the plugin up to and including 1.4.02. A patch has been released in subsequent versions to address the authorization logic.

Affected products

CodePeople Appointment Booking Calendar up to, and including, 1.4.02

Timeline

2026-07-01: advisory: NVD publication date
2026-07-01: disclosed: Wordfence advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.