CVE-2026-18496 wpdevelop CVE debrief

Who should care

Defenders responsible for WordPress installations using the Booking Calendar plugin should assess exposure and prioritize updates to mitigate the risk of sensitive information exposure.

Why it matters

CVE-2026-18496 is a sensitive information exposure vulnerability in the Booking Calendar plugin for WordPress. Defenders should verify the presence of this vulnerability in their installations and update the plugin to mitigate the risk of customer data exposure.

• Verification of WordPress installations for vulnerable Booking Calendar plugin versions is necessary.
• Potential exposure of sensitive customer data, including names, email addresses, and phone numbers.

Technical summary

The Booking Calendar plugin for WordPress, up to and including version 11.4.3, is vulnerable to Sensitive Information Exposure via the wpbc_is_show_popover_in_flex_timeline() function. This vulnerability allows unauthenticated attackers to extract sensitive data, including names, email addresses, and phone numbers of customers who have made bookings. Defenders should verify the presence of this vulnerability in their WordPress installations and update the plugin to a version beyond 11.4.3 if possible. The CVE record and source item provide details about the vulnerability, indicating that the plugin's sensitive information exposure could lead to unauthorized access to customer data.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and update the Booking Calendar plugin to a version beyond 11.4.3 if possible.

Recommended defensive actions

• Verify the version of the Booking Calendar plugin in use and update to a version beyond 11.4.3 if possible.
• Review WordPress installations for the presence of this vulnerability and prioritize updates.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Perform a thorough review of customer data for potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review and update incident response plans to address potential sensitive information exposure.

Evidence notes

The CVE record and source item provide details about the vulnerability in the Booking Calendar plugin. The information indicates that the plugin is vulnerable to sensitive information exposure, allowing unauthenticated attackers to access customer data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.