PT-2026-50638 · WordPress · Appointment Booking Calendar
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Appointment Booking Calendar versions prior to 1.4.02
Description
The plugin is subject to sensitive information exposure due to insufficient authorization and a lack of per-calendar ownership verification within the
cpabc appointments calendar load2() function. This function is accessible via the cpabc calendar load2=1 query parameter in 'wp-admin'. The system only verifies if the user is an administrator or has the edit posts capability, which is granted to users with Contributor-level access and above. Consequently, authenticated attackers with these privileges can provide an arbitrary calendar ID through the id parameter to extract customer booking data, such as names, email addresses, phone numbers, booking times, and comments, from any calendar managed by the plugin.Recommendations
Update the plugin to a version later than 1.4.01.
As a temporary workaround, restrict access to the
cpabc appointments calendar load2() function or the id parameter in the 'wp-admin' area for users with Contributor-level privileges.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Appointment Booking Calendar