CVE-2026-103915 Details
Description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.
A vulnerability allowing sensitive information exposure has been identified in the Booking for Appointments and Events Calendar - Amelia plugin for WordPress, affecting all versions through 2.4.12. The issue arises from the 'page' parameter, which can be exploited by unauthenticated attackers to retrieve personally identifiable information of staff members. This includes full names, email addresses, phone numbers, genders, and timezones. Additionally, internal notes written by administrators for each published event can be accessed. The vulnerability exists because the raw providers array is not properly sanitized before being outputted, allowing this information to be serialized into the JSON response.
Users are advised to update the Booking for Appointments and Events Calendar - Amelia plugin to version 2.4.13 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Amelia | <= 2.4.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |