CVE-2026-12113 is a missing authorization vulnerability (CWE-862) in the Appointment Booking Calendar WordPress plugin by codepeople. Authenticated users with contributor-level privileges or above can exploit the cpabc_appointments_filter_list endpoint to extract sensitive customer information such as names, emails, phone numbers, and appointment comments. The vulnerability affects all plugin versions up to and including 1.4.02. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. No official patch or remediation guidance is currently available.

An attacker with contributor-level access or higher can access sensitive personally identifiable information of customers stored in the booking system. This exposure risks privacy violations and potential misuse of customer data. The vulnerability does not impact system integrity or availability but compromises confidentiality of booking information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to appointment data access.