Appointment Booking Calendar CVE-2026-12111

Exploitation requires an authenticated WordPress session with at minimum the Contributor role, which grants the edit_posts capability. Contributor is a built-in WordPress role commonly assigned to guest bloggers, third-party content contributors, or clients on agency-managed sites - it is not a high-barrier requirement. The vulnerable endpoint is available in any wp-admin session (is_admin() context) and requires no special plugin configuration or non-default settings to be reachable; it is active by default whenever the plugin is installed and active. What limits exploitation: the attacker must hold a valid WordPress account with at least Contributor privileges on the target site - unauthenticated exploitation is not possible per CVSS PR:L. The exposed data is bounded to the Appointment Booking Calendar plugin's own booking tables and does not extend to WordPress core data, other plugins, or the filesystem. There is no code execution, privilege escalation, or integrity impact - the vulnerability is read-only.

The NVD-assigned CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the attack surface in isolation: remote exploitation is trivial once an attacker holds a Contributor account (PR:L), with no interaction or complexity required. However, the raw CVSS score understates the real-world PII risk in multi-tenant or agency-managed WordPress sites, where Contributor accounts are commonly provisioned to third-party writers or clients who should have no access to booking records. The Confidentiality impact is rated Low (C:L) because the exposed data is scoped to the plugin's booking store rather than the full database, but in practice the attacker can enumerate all calendar IDs and systematically drain every customer record in the installation - a behavior that approaches C:H in aggregate for sites with high booking volumes. No EPSS score is provided in the input data, so exploitation probability cannot be quantified numerically. The CVE is not in the CISA KEV catalog and no standalone proof-of-concept tool has been identified, reducing the likelihood of opportunistic mass exploitation. The primary realistic threat actor is a malicious or compromised low-privilege WordPress account holder. SSVC signals: exploitation is unconfirmed/theoretical, the attack is automatable once a Contributor credential is obtained, and technical impact is partial (PII disclosure, no code execution or integrity loss).

An attacker who has registered or compromised a Contributor-level account on a targeted WordPress site authenticates to wp-admin and issues a series of HTTP GET requests to wp-admin with the query parameters cpabc_calendar_load2=1&id=N, incrementing N to enumerate all calendar IDs. For each valid calendar ID, the server returns a dataset containing customer names, email addresses, phone numbers, booking times, and comments belonging to that calendar's bookings. No source code or specialized tooling is required beyond a browser or curl, and the WordPress SVN source references provide sufficient detail for any motivated actor to construct the request manually.