CVE-2026-12113 describes a missing authorization vulnerability in the Appointment Booking Calendar WordPress plugin by codepeople. Authenticated users with contributor-level privileges or above can exploit the cpabc_appointments_filter_list endpoint to extract sensitive customer information such as names, emails, phone numbers, and appointment comments. This vulnerability affects all versions up to and including 1.4.02. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

An attacker with contributor-level or higher access can obtain sensitive personally identifiable information of customers booked through the plugin. This exposure compromises customer privacy but does not affect the integrity or availability of the system. The CVSS score of 4.3 reflects a medium severity impact focused on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to appointment data access.