CVE-2026-12111: Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabcappointmentscalendarload2() function, which is reachable via the cpabccalendarload2=1 query parameter in wp-admin and only checks isadmin() && currentusercan('editposts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Appointment Booking Calendar (WordPress plugin)from your environment.If the plugin is not required, uninstall the Appointment Booking Calendar plugin to eliminate the vulnerable functionality until a fix is available.
- Configuration
Modify cpabc_appointments_calendar_load2() to (1) verify the current user is the owner/manager of the requested calendar ID and (2) replace or augment current_user_can('edit_posts') with a capability limited to administrators or otherwise appropriate roles so Contributor-level users cannot access arbitrary calendar data.
Appointment Booking Calendar (WordPress plugin) authorization checks in cpabc_appointments_calendar_load2() = enforce per-calendar ownership; require an administrator-only capability instead of current_user_can('edit_posts') - Configuration
Temporarily remove the 'edit_posts' capability from the Contributor role or restrict assignment of the Contributor role to trusted users until the plugin is fixed, to prevent Contributors from reaching the vulnerable code path.
WordPress roles/capabilities Contributor 'edit_posts' capability / role assignment = remove or restrict - Compensating control
Restrict access to wp-admin and the cpabc_calendar_load2 endpoint (and similar plugin management endpoints) to trusted IP addresses via firewall, reverse proxy, or WAF to limit which authenticated users can reach the vulnerable code path.
- Operational
Audit access logs for requests to cpabc_calendar_load2 and any unusual access to calendar IDs; identify potentially exposed customer records (emails, names, phone numbers, booking details), notify affected users as required by policy, and take remedial steps (eg. data retraction or password resets) if sensitive account credentials may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12111?
The severity of CVE-2026-12111 is medium with a score of 4.3.
How do I fix CVE-2026-12111?
To fix CVE-2026-12111, update the Appointment Booking Calendar plugin to version 1.4.02 or later.
What type of exposure does CVE-2026-12111 involve?
CVE-2026-12111 involves sensitive information exposure due to insufficient authorization.
Which versions of the Appointment Booking Calendar are affected by CVE-2026-12111?
CVE-2026-12111 affects all versions up to and including 1.4.01 of the Appointment Booking Calendar.
What functions are related to CVE-2026-12111?
CVE-2026-12111 is related to the cpabc_appointments_calendar_load2() function.