Appointment Booking Calendar
Approved changes feed: RSS · Atom
cpe:2.3:a:codepeople:appointment_booking_calendar:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Codepeople (f85d1a73-9b3f-50b5-b09d-cd136586594b) |
|---|---|
| Product | Appointment Booking Calendar (5fab8f5b-af66-55df-92b1-37ac117688d0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wp-plugins/appointment-booking-calendar |
purl2cpe | 2026-06-01 10:10:56.713012 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12113 |
vulnerable | 2026-07-29 00:23:32.038548 |
Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
MEDIUM (4.3)
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.
Published: 2026-07-01T04:32:26.135Z
Updated: 2026-07-01T10:42:11.567Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12111 |
vulnerable | 2026-07-29 00:23:32.037528 |
Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
MEDIUM (4.3)
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function, which is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only checks is_admin() && current_user_can('edit_posts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.
Published: 2026-06-18T06:50:06.952Z
Updated: 2026-06-18T12:42:19.850Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64261 |
vulnerable | 2026-06-08 07:39:18.291902 |
WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability
MEDIUM (5.4)
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.
Published: 2025-11-13T09:24:27.476Z
Updated: 2026-04-28T16:14:12.817Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46247 |
vulnerable | 2026-06-08 07:27:07.838917 |
WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability
MEDIUM (5.3)
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
Published: 2025-04-22T09:53:31.891Z
Updated: 2026-04-28T16:12:36.985Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46241 |
vulnerable | 2026-06-08 07:25:11.366324 |
WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability
HIGH (8.2)
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
Published: 2025-04-22T09:53:28.272Z
Updated: 2026-04-28T16:12:36.933Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13317 |
vulnerable | 2026-06-08 07:04:31.995098 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.