CVE-2026-18496: Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account, privileges, or user interaction are required. Exploitation can expose booking customer names, email addresses, and phone numbers.

Q: Which installations are affected?

The issue affects WPdevelop Booking Calendar versions up to and including 11.4.3. The provided information does not identify a configuration prerequisite, so installations running affected versions should be treated as exposed.

Q: What should be done first?

Update Booking Calendar to a version later than 11.4.3 if one is available. If updating cannot be performed immediately, assess exposure of booking customer data and limit public access where operationally feasible.

Published Oct 10, 2026

Updated

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbcisshowpopoverinflextimeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.

Affected Software

1 affected component

WPdevelop Booking Calendar<=11.4.3

Event History

Oct 10, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account, privileges, or user interaction are required. Exploitation can expose booking customer names, email addresses, and phone numbers.

Which installations are affected?

The issue affects WPdevelop Booking Calendar versions up to and including 11.4.3. The provided information does not identify a configuration prerequisite, so installations running affected versions should be treated as exposed.

What should be done first?

Update Booking Calendar to a version later than 11.4.3 if one is available. If updating cannot be performed immediately, assess exposure of booking customer data and limit public access where operationally feasible.

CVE-2026-18496: Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What should be done first?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What should be done first?