CVE-2026-12113: The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-12113
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-121130.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-12113 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Appointment Booking Calendar
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-15289: The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-ba…nvd · 2026-07-10
- mediumCVE-2026-12433: The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerab…nvd · 2026-07-09
- highCVE-2026-5356: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vul…nvd · 2026-07-08
- highCVE-2026-12378: The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 …nvd · 2026-07-08
- mediumCVE-2026-11398: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vu…nvd · 2026-07-03
- mediumCVE-2026-12657: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vu…nvd · 2026-07-02
More from NVD Recent CVEs
- mediumCVE-2026-15475: A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element i…2026-07-12
- mediumCVE-2026-15474: A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an un…2026-07-12
- mediumCVE-2026-15473: A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects som…2026-07-12
- mediumCVE-2026-15472: A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability aff…2026-07-12
- mediumCVE-2026-15471: A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown par…2026-07-12