CVE-2026-18496— Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
Quick assessment
Affected
wpdevelop Booking Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Booking Calendar 插件在 11.4.3 及更早版本中存在敏感信息泄露漏洞，该漏洞可通过 函数触发。此漏洞允许未经身份验证的攻击者提取客户敏感数据，包括姓名、电子邮件地址和电话号码。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wpdevelop | Booking Calendar | ≤ 11.4.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18496
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wpdevelop | Booking Calendar | 0 ~ 11.4.3 | - |
|
II. Public POCs for CVE-2026-18496
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18496
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-18496 (1)
Vendor Advisories for CVE-2026-18496 (1)
IV. Related Vulnerabilities
Same product: Booking Calendar
-
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Booking Informatio -
CVE-2026-105195
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option D -
CVE-2026-39601
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition -
CVE-2026-93655
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting -
CVE-2026-92561
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting
Same vendor: wpdevelop
-
CVE-2026-39601
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition -
CVE-2026-93655
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting -
CVE-2026-92561
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting -
CVE-2026-92619
Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privile -
CVE-2026-74002
WordPress Booking Calendar plugin <= 11.7 - Broken Access Co
Same weakness: CWE-200
-
CVE-2026-108811
WMCMS index.php information disclosure -
CVE-2026-108810
tsi-coop tsi-dpdp-cms JSON Schema Validation information dis -
CVE-2026-108861
Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via exec -
CVE-2026-108578
Neterbit NW-431F Embedded Web Server sms.json information di -
CVE-2026-103964
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sen
V. Comments for CVE-2026-18496
No comments yet