The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the… (CVE-2026-18496)

CVE-2026-18496 describes a sensitive information exposure vulnerability in the Booking Calendar WordPress plugin affecting all versions up to and including 11.4.3. The flaw exists in the wpbc_is_show_popover_in_flex_timeline() function, which can be exploited by unauthenticated attackers to retrieve personal data of customers who have made bookings, including names, email addresses, and phone numbers. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no indication of active exploitation in the wild or an available patch at this time.

The vulnerability allows unauthorized disclosure of sensitive customer information, impacting confidentiality. There is no impact on data integrity or availability. Exposure of personal data such as names, emails, and phone numbers could lead to privacy violations and potential follow-on attacks such as phishing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected functionality or disabling the plugin if feasible to prevent unauthorized data exposure.