CVE-2026-12111 is a sensitive information exposure vulnerability in the Appointment Booking Calendar plugin for WordPress. The issue arises from inadequate authorization and missing per-calendar ownership verification in the cpabc_appointments_calendar_load2() function, which is accessible via the cpabc_calendar_load2=1 query parameter in the wp-admin interface. The function only verifies that the user is an admin and has the 'edit_posts' capability, which includes Contributor-level users and above. Consequently, an authenticated attacker with such permissions can specify an arbitrary calendar ID through the 'id' parameter and retrieve sensitive booking data from any calendar managed by the plugin.

An attacker with Contributor-level access or higher can extract sensitive customer information including email addresses, names, phone numbers, booking times, and comments from any calendar in the plugin. This exposure compromises customer privacy but does not affect data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user access or higher to trusted users only. Monitor for updates from the vendor regarding a security patch addressing this authorization flaw.