Appointment Booking Calendar EUVD-2026-40903

Exploitation requires an authenticated WordPress session with at least contributor-level role (PR:L per CVSS). The Appointment Booking Calendar plugin must be installed and active on the target WordPress site. No non-default configuration or special feature enablement is required beyond the plugin's presence - the cpabc_appointments_filter_list AJAX action is registered as part of standard plugin initialization. Exploitation is limited by the authentication barrier: unauthenticated visitors cannot invoke the endpoint, and sites that grant contributor access only to trusted users face lower practical risk. The attack is network-accessible (AV:N) with no user interaction (UI:N), meaning an attacker with valid credentials can exploit it remotely with a single HTTP request.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the threat model: the attack is network-reachable, requires no special conditions, and needs only a contributor-level WordPress account, but the impact is limited to confidentiality of booking PII with no integrity or availability consequence and no scope change. No EPSS data was supplied and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. However, the practical impact on affected site operators is non-trivial: booking PII (names, emails, phone numbers, appointment notes) constitutes personally identifiable information with GDPR/CCPA relevance, and any multi-author WordPress site that grants contributor access to untrusted users - a common configuration - is directly exposed. The low CVSS score is appropriate from a purely technical standpoint but may understate regulatory and reputational risk. No conflicting signals between the CVSS vector and description are present; both consistently point to an authenticated, low-privilege network attack with confidentiality-only impact.

An attacker registers or obtains a contributor-level WordPress account on a target site running the Appointment Booking Calendar plugin. They send an authenticated POST request to wp-admin/admin-ajax.php with action=cpabc_appointments_filter_list and any required nonce, and the server responds with the full appointment booking dataset containing customer names, email addresses, phone numbers, and appointment comments. No public proof-of-concept code was identified, but the source code references in the plugin's SVN Trac browser make the vulnerable code path trivially discoverable by any attacker inspecting the plugin.