Junglewise Threat Intelligence

CVE-2026-12113: CodePeople Appointment Booking Calendar sensitive information exposure

CVE-2026-12113 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Technologies: CodePeople Appointment Booking Calendar. Vendors: CodePeople.

Executive brief

The Appointment Booking Calendar plugin for WordPress, which manages customer scheduling and reservations, contains a security flaw that exposes sensitive information. An individual with basic contributor-level access to the website can view private customer details, including names, email addresses, phone numbers, and appointment comments. This could lead to the unauthorized disclosure of personally identifiable information (PII) and potential privacy violations for your customers.

Technical details

The Appointment Booking Calendar plugin for WordPress is vulnerable to sensitive information exposure due to missing authorization checks in the cpabc_appointments_filter_list function. The vulnerability is classified as CWE-862 (Missing Authorization). An authenticated attacker with at least contributor-level privileges can exploit this flaw via a network request to access the vulnerable component. Successful exploitation allows the attacker to extract sensitive booking data, including customer names, emails, phone numbers, and private comments. The issue affects all versions of the plugin up to and including 1.4.02. A patch has been released in subsequent versions to address the authorization logic.

Affected products

  • CodePeople Appointment Booking Calendar up to, and including, 1.4.02

Timeline

  • 2026-07-01: advisory: NVD publication date
  • 2026-07-01: disclosed: Wordfence advisory published

References

Related threats