The Booking Calendar WordPress plugin is vulnerable to sensitive information exposure through the wpbc_is_show_popover_in_flex_timeline() function. The flaw allows unauthenticated users to retrieve customer data—names, email addresses, and phone numbers—by exploiting the AJAX action tied to the plugin. The security weakness is captured by CWE‑200, indicating informational leakage without proper access controls.

WordPress sites that use the wpdevelop Booking Calendar plugin in any version up to and including 11.4.3. This includes all installations that have not applied a later release of the plugin, regardless of WordPress core or theme version.

The CVSS score of 5.3 places this vulnerability in the moderate severity range. The EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation reports yet. Because the attack vector is unauthenticated and hinges on a publicly exposed AJAX endpoint, an attacker can simply send a crafted request from anywhere on the internet to obtain the affected data. No code execution or privilege escalation is possible, but the exposure of customer contact information can lead to phishing, spam, or other privacy violations.