What is the CVSS score of CVE-2026-12113?

CVE-2026-12113 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Appointment Booking Calendar CVE-2026-12113

EUVD-2026-40903 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 Wordfence

GHSA-jg95-92mw-5qqj

WordPress Authentication Bypass Information Disclosure Appointment Booking Calendar Wordpress Plugin Codepeople

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Endpoint reachable over network (AV:N), contributor login required (PR:L), only booking PII disclosed with no write or availability impact (C:L/I:N/A:N), no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:32 vuln.today

CVE Published

Jul 01, 2026 - 04:32 nvd

MEDIUM 4.3

DescriptionCVE.org

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.

AnalysisAI

Sensitive PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.02) allows any authenticated user with contributor-level access to retrieve customer booking records - including names, email addresses, phone numbers, and appointment comments - via the unprotected cpabc_appointments_filter_list AJAX action. The root cause is CWE-862 (Missing Authorization): the endpoint performs no capability check before returning data, meaning the attacker's only prerequisite is a valid WordPress login at contributor tier or above. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a source-level fix appears committed in the plugin's SVN repository (changeset 3581633).

Technical ContextAI

The vulnerability resides in the Codepeople Appointment Booking Calendar WordPress plugin (CPE: cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:*:*:*). WordPress plugins register AJAX handlers via wp_ajax_* or wp_ajax_nopriv_* hooks; the cpabc_appointments_filter_list handler, implemented across cpabc_apps_on.inc.php (lines 255 and 328) and cpabc_appointments.php (line 187), retrieves appointment booking records from the database and returns them to the caller. CWE-862 (Missing Authorization) describes exactly this pattern: the code verifies that the caller is logged in (hence PR:L), but never checks whether the authenticated user holds a capability sufficient to access customer PII such as manage_options or a custom role. Any WordPress user at the default contributor role - a tier frequently granted to untrusted guest authors - can therefore invoke the endpoint and exfiltrate the full booking dataset.

RemediationAI

Update the Appointment Booking Calendar plugin to the version that incorporates SVN changeset 3581633, which reflects the upstream source-level fix committed to the plugin's trunk; however, the specific patched release version number is not independently confirmed in the available data - verify the current version in the WordPress plugin repository before updating. As an interim workaround on sites where immediate update is not possible, restricting the WordPress contributor role by removing untrusted contributor accounts reduces exposure, since exploitation requires at minimum contributor-level authentication. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php where action=cpabc_appointments_filter_list from non-administrator sessions can serve as a compensating control, though this may break legitimate plugin functionality for shop managers who rely on the filter. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3838bb64-fd85-43a4-97a2-7ca7930697ad should be monitored for the confirmed patched version number.