CVE-2026-12113: WordPress Appointment Booking Calendar Sensitive Data Exposure

Technical summary

CVE-2026-12113 is an insecure direct object reference (IDOR) vulnerability in the Appointment Booking Calendar WordPress plugin affecting versions 1.4.02 and earlier. The vulnerability resides in the cpabc_appointments_filter_list function, which fails to properly enforce access controls on appointment data endpoints. An authenticated user with contributor-level or higher permissions can query this function to retrieve appointment records without proper authorization checks, resulting in exposure of personally identifiable information (PII) including customer contact details and booking metadata. The vulnerability requires network access and a valid WordPress account but no user interaction, making it a straightforward privilege escalation issue within the plugin's data retrieval logic.

Business impact

Organizations using this plugin to manage customer appointments face direct exposure of booking data and customer PII. Depending on your jurisdiction and customer base, unauthorized access to names, email addresses, phone numbers, and appointment notes may trigger data protection compliance obligations (GDPR, CCPA, etc.). Even with a CVSS score of 4.3, the business risk is significant: loss of customer trust, potential regulatory fines, notification obligations, and reputational damage if appointment data is exploited. The vulnerability is particularly concerning for healthcare practices, salons, consultants, and other service providers relying on this plugin for sensitive booking workflows.

Affected systems

All installations of the Appointment Booking Calendar WordPress plugin up to and including version 1.4.02 are vulnerable. The vulnerability is triggered only when a user with contributor-level access or higher is present on the WordPress site. Sites using older versions, sites with extensive contributor/author accounts, or multi-user WordPress installations with loose permission policies face higher risk. The plugin must be actively installed and used; disabling it eliminates the attack surface.

Exploitability

Exploitability is straightforward for anyone with existing WordPress access at contributor level or above. No zero-day knowledge, special tools, or public exploits are required—the attacker simply needs valid credentials and the plugin enabled. The attack is invisible to site logs under typical WordPress logging, making detection difficult without plugin-specific monitoring. The low barrier to exploitation stems from the fact that many sites grant contributor access to freelancers, part-time staff, or guest authors who have no legitimate reason to view appointment data. This is not an unauthenticated attack, but the 'L' privilege requirement is low enough to be a concern in multi-user environments.

Remediation

Update the Appointment Booking Calendar plugin immediately to the version patched after 1.4.02. Verify the available update in your WordPress plugin dashboard or consult the plugin's official repository or vendor advisory for the patched version number and release date. As an interim mitigation, audit your WordPress user roles and reduce contributor-level access to only those users who genuinely require it. Consider disabling the plugin temporarily if no patch is available and if a suitable alternative scheduling solution exists. After patching, review WordPress user accounts and remove or downgrade any contributor-level users whose roles have changed.

Patch guidance

Check your WordPress Plugins dashboard for an available update to the Appointment Booking Calendar plugin. The patch will be released in a version after 1.4.02; verify the exact version number against the plugin's official advisory or repository page before applying. Apply the patch in a staging environment first to confirm no functional regressions with your appointment workflows. After patching, perform a manual review of appointment records accessible to your contributor and author users to ensure the fix restricts visibility correctly. If you are on an older version, ensure your WordPress core and all other plugins are also current, as this will reduce overall attack surface.

Detection guidance

Monitor WordPress user access logs for any contributor or author accounts querying the cpabc_appointments_filter_list function or accessing appointment data via the plugin's API endpoints. Enable WordPress security logging if not already active; use plugins or server-level monitoring to flag unusual data access patterns from low-privilege accounts. Review appointment database queries in your application or database logs for signs of bulk extraction. After applying the patch, validate that the access control fix is working by attempting to query appointment data as a contributor and confirming the request is denied. Set up ongoing monitoring for changes to plugin versions and security updates.

Why prioritize this

Despite its MEDIUM CVSS score of 4.3, this vulnerability warrants prompt remediation because it directly exposes customer PII in a way that is easily exploitable by any contributor-level user. The low complexity, combined with the sensitivity of the data at risk (contact information, appointment notes) and compliance implications, makes it a business priority even though no remote unauthenticated attack is possible. Sites with large contributor bases or frequent staff turnover should prioritize this patch within 1–2 weeks of availability.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the vulnerability's moderate risk profile: network accessibility and low privilege requirement offset by the lack of user interaction and the limited scope (confidentiality impact only). The score does not account for the business or compliance impact of PII exposure, which can be substantial in practice. For organizations handling sensitive appointment data (healthcare, counseling, legal), the real-world risk often exceeds the numerical score. The score is appropriate from a technical perspective but should be contextualized within your own data classification and regulatory landscape.

Frequently asked questions