CVE-2026-121114.3MediumCWE-200

CVE-2026-12111: Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter

codepeople · Appointment Booking Calendar

Affected: codepeople Appointment Booking Calendar · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

20th percentile

050100

Higher than 20% of scored CVEs

4.3MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function, which is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only checks is_admin() && current_user_can('edit_posts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

codepeople · Appointment Booking Calendarup to and including 1.4.01

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Information Exposure · Information Disclosure
Vendor: codepeople
Published: June 2026
Band: Unlikely (under 1%), June 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-12111 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.