Description
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wpdevelop | Booking Calendar | ≤ 11.4.3 | — |