Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-103915

Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

The Booking for Appointments and Events Calendar (Amelia) plugin for WordPress is affected by this flaw, which lets someone without a login access sensitive data through a URL parameter. Exposed information can include staff names, email addresses, phone numbers, gender, time zones, and internal notes attached to published events.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • melograno Booking for Appointments and Events Calendar – Amelia

    through 2.4.12

References 5

wordfence.com

plugins.trac.wordpress.org