The Appointment Booking Calendar plugin for WordPress contains a flaw that allows an authenticated user with Contributor-level permissions or higher to retrieve customer booking details by supplying a calendar identifier. The vulnerability originates from an authorization bypass: the cpabc_appointments_calendar_load2() handler only verifies is_admin() and the capability edit_posts, ignoring the ownership of individual calendars. Because this check is too permissive, any contributor can ask for the contents of any calendar managed by the plugin and view email addresses, names, phone numbers, booking times and comments. The result is sensitive information exposure affecting confidentiality for all users with access to booking data.

Any WordPress site that has installed the Appointment Booking Calendar plugin by codepeople up to and including version 1.4.01 is impacted. Sites using earlier or later releases are not affected.

CVSS base score of 4.3 indicates a moderate threat, with an EPSS score below 1% signaling a low probability of exploitation at this time. The weakness is not listed in CISA KEV. Attacking requires only a valid user account with the edit_posts capability; no remote code execution or privilege escalation is needed. The exploit path is straightforward: a contributor user can append the cpabc_calendar_load2=1 and id parameters to a WP‑admin URL, causing the plugin to return booking data for the specified calendar.