5.3
Medium
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
CVE-2026-103915
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.
Assessment
- CVSS
- 5.3 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 31 October 2026
- Last updated
- 31 October 2026
- Affected
- melograno
- Assigner
- Wordfence
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
At the source
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/25571e59-c966-4d30-9453-42b63778b9a0?source=cve
- https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/src/Application/Commands/Booking/Event/GetEventsCommandHandler.php#L72
- https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/src/Application/Commands/Booking/Event/GetEventsCommandHandler.php#L401
- https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/src/Application/Controller/Booking/Event/GetEventsController.php#L29
- https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/ameliabooking.php#L1220
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-103915