CVE-2026-18496: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in wpdevelop Booking Calendar

CVE-2026-18496 is a vulnerability in the Booking Calendar WordPress plugin affecting all versions up to and including 11.4.3. It allows unauthenticated attackers to exploit the wpbc_is_show_popover_in_flex_timeline() function to extract sensitive customer data including names, emails, and phone numbers. The vulnerability is categorized under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can retrieve sensitive customer information such as names, email addresses, and phone numbers from the Booking Calendar plugin. This exposure could lead to privacy violations and potential misuse of personal data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's advisories for updates and consider restricting access to the affected functionality until a fix is available.