WordPress Appointment Booking Calendar <= 1.4.01 Authenticated Sensitive Information Exposure via 'id' Parameter (CVE-2026-12111)

Vulnerability Overview Vulnerability Name: Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter CVE ID: CVE-2026-12111 CVSS Score: 4.3 (Medium) Release Date: June 17, 2026 Last Updated: June 18, 2026 Researchers: Chloe Chamberland - Wordfence PRISM Scope of Impact Affected Versions: <= 1.4.01 Vulnerability Type: Sensitive Information Exposure Description: The Appointment Booking Calendar plugin, in versions <= 1.4.01, contains a sensitive information exposure vulnerability. This issue arises from the absence of a calendar ownership check within the function. Consequently, an authenticated attacker with Contributor level or higher privileges can exploit the parameter to retrieve arbitrary calendar IDs and extract customer booking details, including email addresses, names, phone numbers, booking times, and comments. Remediation Fixed Version: 1.4.02 Recommendation: Upgrade to version 1.4.02 or later. Additional Information Reference Links: Multiple plugins.trac.wordpress.org links Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities List of Recent Vulnerabilities: - CVE-2025-13317: Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_checkeck' Parameter - CVE-2025-54261: Missing Authorization - CVE-2025-46247: Missing Authorization - CVE-2025-46241: Cross-Site Request Forgery to SQL Injection - CVE-2024-0856: Cross-Site Request Forgery - CVE-2022-43482: Missing Authorization - CVE-2020-9371: Stored Cross-Site Scripting - CVE-2020-9372: CSV Injection - CVE-2019-14791: Cross-Site Scripting - CVE-2016-1224: SQL Injection Notes Disclaimer: This record contains copyrighted material; see the bottom of the page for specific copyright information. Contact Information Contact Email: info@support@wordfence.com Business Hours Support Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7/365 support with a 1-hour response time Other Links Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Facebook: [Icon] Twitter: [Icon] LinkedIn: [Icon] Instagram: [Icon] Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscription Subscription Form: - Enter email address - Check to agree to Terms of Service and Privacy Policy - Click "SIGN UP" button Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Appointment Booking Calendar <= 1.4.01 Authenticated Sensitive Information Exposure via 'id' Parameter (CVE-2026-12111)

More from this source