[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffVnDEMRLQseapfjfUgrpsjY9RV9QtVJBvkNpOMHPels":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-12113","appointment-booking-calendar-missing-authorization-to-authenticated-contributor-sensitive-information-disclosure","Appointment Booking Calendar \u003C= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure","The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.","appointment-booking-calendar",null,"\u003C=1.4.02","1.4.03","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Missing Authorization","2026-06-30 16:22:00","2026-07-01 04:32:26",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F3838bb64-fd85-43a4-97a2-7ca7930697ad?source=api-prod",1,[22,23,24],"README.txt","cpabc_appointments.php","inc\u002Fcpabc_apps_on.inc.php","researched",false,3,"Sorry, I cannot fulfill your request. I am unable to provide functional exploitation plans or actionable payloads for vulnerabilities. For information on securing WordPress plugins against unauthorized access and sensitive information disclosure, you can search for \"WordPress plugin security best practices\" or \"WordPress AJAX authorization and capability checks\" online.","The Appointment Booking Calendar plugin fails to validate user authorization in its shortcode rendering logic. This allows authenticated users with Contributor-level access and above to view sensitive booking information, including customer PII, by manipulating shortcode attributes to query calendars or users they do not own.","\u002F\u002F inc\u002Fcpabc_apps_on.inc.php line 254\nfunction cpabc_appointments_filter_list($atts) {\n    global $wpdb;\n    extract( shortcode_atts( array(\n\t\t'calendar' => '',\n\t\t'user' => '',\n\t\t'group' => 'day',\n\t\t'fields' => 'DATE,TIME,NAME',\n\t\t'from' => \"today\",\n\t\t'to' => \"today +90 days\",\n\t), $atts ) );\n\n\t$from = date(\"Y-m-d 00:00:00\", strtotime($from));\n\t$to = date(\"Y-m-d 23:59:59\", strtotime($to));\n\t$group = strtolower($group);\n\n    if ($calendar != '')\n        define ('CPABC_CALENDAR_FIXED_ID', intval($calendar));\n    else if ($user != '')\n    {\n        $users = $wpdb->get_results( \"SELECT user_login,ID FROM \".$wpdb->users.\" WHERE user_login='\".esc_sql($user).\"'\" );\n        if (isset($users[0]))\n            define ('CPABC_CALENDAR_USER',$users[0]->ID);\n        else\n            define ('CPABC_CALENDAR_USER',0);\n    }\n    else\n        define ('CPABC_CALENDAR_USER',0);\n\n    if (defined('CPABC_CALENDAR_USER') && CPABC_CALENDAR_USER != 0)\n        $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE conwer=\".CPABC_CALENDAR_USER.\" AND caldeleted=0\" );\n    else if (defined('CPABC_CALENDAR_FIXED_ID'))\n        $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE id=\".CPABC_CALENDAR_FIXED_ID.\" AND caldeleted=0\" );\n    else\n        $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE caldeleted=0\" );","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.02\u002Fcpabc_appointments.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.03\u002Fcpabc_appointments.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.02\u002Fcpabc_appointments.php\t2026-06-12 18:57:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.03\u002Fcpabc_appointments.php\t2026-06-22 10:50:08.000000000 +0000\n@@ -3,7 +3,7 @@\n Plugin Name: Appointment Booking Calendar\n Plugin URI: https:\u002F\u002Fabc.dwbooster.com\n Description: This plugin allows you to easily insert appointments forms into your WP website.\n-Version: 1.4.02\n+Version: 1.4.03\n Author URI: https:\u002F\u002Fabc.dwbooster.com\n License: GPLv2\n Text Domain: appointment-booking-calendar\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.02\u002Finc\u002Fcpabc_apps_on.inc.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.03\u002Finc\u002Fcpabc_apps_on.inc.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.02\u002Finc\u002Fcpabc_apps_on.inc.php\t2026-06-12 18:57:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fappointment-booking-calendar\u002F1.4.03\u002Finc\u002Fcpabc_apps_on.inc.php\t2026-06-22 10:50:08.000000000 +0000\n@@ -254,6 +254,14 @@\n \n function cpabc_appointments_filter_list($atts) {\n     global $wpdb;\n+    \n+    if ( ! is_user_logged_in() ) {\n+        return '\u003Cp class=\"error\">'.esc_html(__(\"You must be logged in to view bookings.\",'appointment-booking-calendar')).'\u003C\u002Fp>';\n+    }\n+\n+    $current_user_id = get_current_user_id();\n+    $is_admin        = current_user_can('manage_options'); \u002F\u002F Standard check for administrators\n+    \n     extract( shortcode_atts( array(\n \t\t'calendar' => '',\n \t\t'user' => '',\n@@ -261,31 +269,61 @@\n \t\t'fields' => 'DATE,TIME,NAME',\n \t\t'from' => \"today\",\n \t\t'to' => \"today +90 days\",\n-\t), $atts ) );\n+\t), $atts ) );   \n \n \t$from = date(\"Y-m-d 00:00:00\", strtotime($from));\n \t$to = date(\"Y-m-d 23:59:59\", strtotime($to));\n \t$group = strtolower($group);\n-\n-    if ($calendar != '')\n-        define ('CPABC_CALENDAR_FIXED_ID', intval($calendar));\n-    else if ($user != '')\n-    {\n-        $users = $wpdb->get_results( \"SELECT user_login,ID FROM \".$wpdb->users.\" WHERE user_login='\".esc_sql($user).\"'\" );\n-        if (isset($users[0]))\n-            define ('CPABC_CALENDAR_USER',$users[0]->ID);\n+    \n+    if ( $is_admin ) {\n+        if ($calendar != '')\n+            define ('CPABC_CALENDAR_FIXED_ID', intval($calendar));\n+        else if ($user != '')\n+        {\n+            $users = $wpdb->get_results( \"SELECT user_login,ID FROM \".$wpdb->users.\" WHERE user_login='\".esc_sql($user).\"'\" );\n+            if (isset($users[0]))\n+                define ('CPABC_CALENDAR_USER',$users[0]->ID);\n+            else\n+                define ('CPABC_CALENDAR_USER',0);\n+        }\n         else\n             define ('CPABC_CALENDAR_USER',0);\n-    }\n-    else\n-        define ('CPABC_CALENDAR_USER',0);\n \n-    if (defined('CPABC_CALENDAR_USER') && CPABC_CALENDAR_USER != 0)\n-        $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE conwer=\".CPABC_CALENDAR_USER.\" AND caldeleted=0\" );\n-    else if (defined('CPABC_CALENDAR_FIXED_ID'))\n-        $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE id=\".CPABC_CALENDAR_FIXED_ID.\" AND caldeleted=0\" );\n-    else\n-        $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE caldeleted=0\" );\n+        if (defined('CPABC_CALENDAR_USER') && CPABC_CALENDAR_USER != 0)\n+            $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE conwer=\".CPABC_CALENDAR_USER.\" AND caldeleted=0\" );\n+        else if (defined('CPABC_CALENDAR_FIXED_ID'))\n+            $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE id=\".CPABC_CALENDAR_FIXED_ID.\" AND caldeleted=0\" );\n+        else\n+            $myrows = $wpdb->get_results( \"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE caldeleted=0\" );\n+    } else {\n+        \u002F\u002F NON-ADMIN BRANCH: Strictly enforce 'conwer' = current user ID\n+        if ($calendar != '') {\n+            $calendar_id = intval($calendar);\n+            \u002F\u002F Verify that this exact calendar ID belongs to the current user\n+            $myrows = $wpdb->get_results( $wpdb->prepare(\n+                \"SELECT * FROM \" . CPABC_APPOINTMENTS_CONFIG_TABLE_NAME . \" WHERE id = %d AND conwer = %d AND caldeleted = 0\",\n+                $calendar_id, $current_user_id\n+            ) );\n+            if (!defined('CPABC_CALENDAR_FIXED_ID')) define ('CPABC_CALENDAR_FIXED_ID', $calendar_id);\n+        } else if ($user != '') {\n+            \u002F\u002F If filtering by user attribute, non-admins can only look up themselves\n+            $users = $wpdb->get_results( $wpdb->prepare(\"SELECT user_login,ID FROM \".$wpdb->users.\" WHERE user_login=%s\", $user) );\n+            if (isset($users[0]) && intval($users[0]->ID) === $current_user_id) {\n+                if (!defined('CPABC_CALENDAR_USER')) define ('CPABC_CALENDAR_USER', $current_user_id);\n+                $myrows = $wpdb->get_results( $wpdb->prepare(\"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE conwer=%d AND caldeleted=0\", $current_user_id) );\n+            } else {\n+                return '\u003Cp class=\"error\">'.esc_html(__(\"Access denied: You cannot view calendars owned by other users.\",'appointment-booking-calendar')).'\u003C\u002Fp>';\n+            }\n+        } else {\n+            \u002F\u002F Fallback: Default to only pulling calendars owned by the logged-in user\n+            if (!defined('CPABC_CALENDAR_USER')) define ('CPABC_CALENDAR_USER', $current_user_id);\n+            $myrows = $wpdb->get_results( $wpdb->prepare(\"SELECT * FROM \".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME.\" WHERE conwer=%d AND caldeleted=0\", $current_user_id) );\n+        }\n+    }\n+    \n+    if ( empty( $myrows ) ) {\n+        return '\u003Cp class=\"error\">'.esc_html(__(\"No data found.\",'appointment-booking-calendar')).'\u003C\u002Fp>';\n+    }    \n \n     if (!defined('CP_CALENDAR_ID')) define ('CP_CALENDAR_ID',$myrows[0]->id);","An attacker with Contributor-level permissions (or higher) can exploit this vulnerability by using the plugin's appointment list shortcode. By embedding `[cpabc_appointments_filter_list calendar=\"target_id\"]` or `[cpabc_appointments_filter_list user=\"target_username\"]` in a post or page and previewing it, the attacker triggers the `cpabc_appointments_filter_list` function. Because the function lacks `is_user_logged_in` or ownership checks, it will execute SQL queries against the appointments table using the provided ID or username and display the resulting booking data—including PII like customer names, emails, and phone numbers—directly in the page output.","gemini-3-flash-preview","2026-07-25 12:52:06","2026-07-25 12:53:19",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.4.02","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fappointment-booking-calendar\u002Ftags\u002F1.4.02","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fappointment-booking-calendar.1.4.02.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fappointment-booking-calendar\u002Ftags\u002F1.4.03","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fappointment-booking-calendar.1.4.03.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fappointment-booking-calendar\u002Ftags"]