Is CVE-2026-12113 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-12113?

CVE-2026-12113 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-12113

Description

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.