What is the CVSS score of CVE-2026-12111?

CVE-2026-12111 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Appointment Booking Calendar CVE-2026-12111

EUVD-2026-37864 MEDIUM

Information Exposure (CWE-200)

2026-06-18 Wordfence

GHSA-w9f2-px6f-gvmg

WordPress Information Disclosure Appointment Booking Calendar Wordpress Plugin Codepeople

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable wp-admin endpoint requires only Contributor-level authentication (PR:L); no complexity or interaction; confidentiality limited to plugin booking data (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 08:08 vuln.today

CVE Published

Jun 18, 2026 - 06:50 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function, which is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only checks is_admin() && current_user_can('edit_posts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.

AnalysisAI

Sensitive customer PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.01) allows any authenticated user with Contributor-level access to exfiltrate booking records from calendars they do not own. The root cause is an IDOR (Insecure Direct Object Reference) in the cpabc_appointments_calendar_load2() function: the function enforces only a broad role check (edit_posts capability) without verifying that the requesting user owns the calendar ID supplied via the id parameter. Exposed records include customer names, email addresses, phone numbers, booking times, and freeform comments, making this a meaningful PII breach risk on multi-author WordPress installations. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is identified by CPE cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:*:*:* (Codepeople's Appointment Booking Calendar plugin). The vulnerable code resides in inc/cpabc_apps_go.inc.php at the cpabc_appointments_calendar_load2() function, reachable by appending cpabc_calendar_load2=1 to any wp-admin URL. The authorization gate uses the WordPress API check is_admin() && current_user_can('edit_posts'), which grants passage to any user holding the Contributor role or higher - a deliberately low-privilege role in WordPress intended for draft content submission, not data administration. Because the function accepts a caller-supplied integer as the calendar id without confirming that the authenticated user is the owner or manager of that calendar, any Contributor can enumerate calendar IDs and retrieve full booking datasets for calendars belonging to other site users or administrators. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), more precisely manifesting as a missing ownership/authorization check on object access - a pattern also described as IDOR. WordPress SVN references (trunk and tags/1.3.99 at L1018, L1019, L945, and cpabc_appointments.php L142) confirm the affected code paths, and changeset 3570448 represents the upstream fix commit.

RemediationAI

The primary fix is to update the Appointment Booking Calendar plugin beyond version 1.4.01. WordPress SVN changeset 3570448 contains the upstream patch applied to trunk; however, the exact released plugin version incorporating this fix is not explicitly stated in the available data - site administrators should verify the current version in the WordPress Plugin Directory before upgrading and confirm it is newer than 1.4.01. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ecc237-87b0-4c4d-94cc-d3af9c6669c5 should be monitored for a confirmed patched version number. If immediate patching is not possible, the most effective compensating control is to audit and remove Contributor-level (and above) accounts that do not require access to wp-admin booking data, thereby eliminating the pool of potential attackers. A second interim control is to use a WordPress security plugin or WAF rule to block requests containing the cpabc_calendar_load2=1 query parameter from non-administrator roles; this carries the trade-off of breaking legitimate administrative calendar-loading functionality for lower-privileged admins. Disabling the plugin entirely eliminates the risk but also removes booking functionality. Network-layer restrictions on wp-admin access (e.g., IP allowlisting) reduce exposure but do not eliminate it if the attacker already has a valid Contributor credential on an allowlisted network.