CVE-2026-12113

MEDIUM

Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-12113. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-12113, a sensitive information exposure vulnerability in the WordPress Appointment Booking Calendar plugin (versions ≤1.4.02). The code includes placeholder logic for target probing but lacks actual exploit implementation for the `cpabc_appointments_filter_list` endpoint.

Description

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-12113_the_appointment_booking.py

View Code ZIP pw:eip

This repository contains an auto-generated stub module for CVE-2026-12113, a sensitive information exposure vulnerability in the WordPress Appointment Booking Calendar plugin (versions ≤1.4.02). The code includes placeholder logic for target probing but lacks actual exploit implementation for the `cpabc_appointments_filter_list` endpoint.

Classification

Stub 99%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Theoretical

Target: WordPress Appointment Booking Calendar plugin ≤1.4.02

No auth needed

Prerequisites: Target must have the vulnerable plugin installed and accessible via HTTP/HTTPS · Network connectivity to the target's web server

MITRE ATT&CK