CVE-2024-12274: Codepeople Appointment Booking Calendar

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).

Affected products

• Codepeople Appointment Booking Calendar: before 1.1.23 (fixed in 1.1.23)

Published 2025-01-13. Last modified 2026-06-17.