CVE-2026-12111: Appointment Booking Calendar WordPress Plugin Information Disclosure Vulnerability

Technical summary

CVE-2026-12111 is an information disclosure vulnerability in the Appointment Booking Calendar WordPress plugin (versions ≤1.4.01). The vulnerable cpabc_appointments_calendar_load2() function is accessible via the cpabc_calendar_load2=1 query parameter in the wp-admin backend. The authorization mechanism relies solely on is_admin() && current_user_can('edit_posts'), which grants access to any authenticated user with Contributor capability or higher. The function does not implement per-calendar ownership validation, allowing attackers to supply an arbitrary calendar ID and retrieve sensitive booking records. This represents a missing authorization control (CWE-200) that bypasses the intended multi-tenant access model.

Business impact

This vulnerability exposes customer personally identifiable information (PII) to unauthorized internal users. Organizations relying on the plugin to manage appointment bookings risk disclosure of customer names, email addresses, phone numbers, and booking details. The exposure is limited to authenticated WordPress users with Contributor access or above, reducing the overall blast radius, but still presents material privacy risk—particularly for healthcare, service, or consultation businesses that handle sensitive customer data through appointment systems. Breach notification obligations may be triggered depending on jurisdiction and data sensitivity.

Affected systems

Appointment Booking Calendar plugin for WordPress in versions up to and including 1.4.01. The vulnerability requires authenticated WordPress access at the Contributor level or higher; unauthenticated attackers cannot exploit this issue. Any WordPress installation running a vulnerable version with multiple users or role-based access controls is at risk of unauthorized information disclosure.

Exploitability

Exploitation requires valid WordPress authentication with at least Contributor capability. Attack complexity is low—an attacker simply manipulates the cpabc_calendar_load2 query parameter and supplies an arbitrary calendar ID to retrieve records. No user interaction or special conditions are required beyond the initial authentication. The vulnerability is straightforward to discover and exploit once an attacker has legitimate WordPress access, making it a credible risk in multi-user WordPress environments or scenarios where trust boundaries between user roles are not strictly enforced.

Remediation

Update the Appointment Booking Calendar plugin to a patched version that implements per-calendar ownership checks. Verify against the vendor advisory for the specific patched version number. In the interim, restrict the Contributor role to users who genuinely require post-editing capabilities; review user roles and remove unnecessary elevated permissions. Consider disabling the plugin if it is not actively used. Implement network-level access controls to limit wp-admin access to trusted IP ranges or networks.

Patch guidance

Consult the official Appointment Booking Calendar plugin repository and vendor security advisory for the patched version. Apply the update as soon as it is released and verified. Test in a staging environment before production deployment to ensure compatibility with your WordPress configuration, themes, and other plugins. After patching, verify that the cpabc_appointments_calendar_load2() function now enforces ownership checks before returning calendar data.

Detection guidance

Monitor WordPress access logs and audit trails for unusual queries to wp-admin containing the cpabc_calendar_load2=1 parameter, especially from Contributor-level accounts accessing calendar IDs that do not belong to them. Review plugin activity logs if the plugin provides them. Conduct user access audits to identify Contributor-level accounts that should not have edit_posts capability. If forensic investigation is needed, check web server logs for POST or GET requests with the vulnerable parameter combined with varying calendar ID values.

Why prioritize this

This vulnerability warrants attention but is not critical. CVSS 4.3 (Medium) reflects the limited scope—authenticated access is required, and the impact is confidentiality only. However, the ease of exploitation and direct exposure of customer PII make it a clear candidate for near-term remediation, especially in multi-user WordPress environments. Organizations with strict role separation or single-user WordPress instances face lower risk but should still update.

Risk score, explained

CVSS 3.1 score of 4.3 is driven by: (1) Low attack complexity—the vulnerability requires only parameter manipulation; (2) Low privilege requirement—Contributor access is commonly granted; (3) No user interaction required; (4) Network-accessible vector; (5) Confidentiality impact limited to sensitive user data accessible to the attacker; (6) No integrity or availability impact. The score reflects a real but bounded risk suitable for planned remediation rather than emergency response.

Frequently asked questions