Path traversal in OpenList prior to v4.2.3 allows any authenticated user holding the PermAddOfflineDownload permission to write, truncate, or overwrite arbitrary files accessible to the OpenList process via the SimpleHttp offline-download tool. The attacker controls a remote HTTP server that returns a crafted Content-Disposition header containing path-traversal sequences; OpenList uses the attacker-supplied filename without containment validation to construct a file path via filepath.Join relative to a per-task temporary directory, allowing traversal outside that directory. No public exploit has been identified at time of analysis, though the GHSA advisory details the exact vulnerable function and the fix commit is publicly accessible, significantly lowering the effort required to develop one.
Quadratic algorithmic complexity (O(D²)) in stream-json's pick, ignore, filter, and replace path filters allows an attacker supplying a small, deeply-nested JSON document to block the Node.js event loop for seconds to minutes, effectively causing denial of service. The root cause is that filter-base.js recomputes the full dot-separated path string by rejoining the entire nesting stack on every checkable token - so a document of depth D incurs O(D²) CPU work regardless of byte size. All applications passing untrusted or large JSON through a string or RegExp filter (including the library's flagship README example pick({filter: 'data'})) are affected in versions up to and including 3.4.0. A proof-of-concept is included in the published GHSA advisory; no public exploit or CISA KEV listing has been identified at time of analysis.
Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the `pwd` argument to the `parseIf` function in `seacms_locoy_news.php`. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 allows remote attackers to enumerate and extract database contents by exploiting the email parameter in the patient login endpoint (/patient_login.php) via time-based blind techniques. A public GitHub proof-of-concept documents the exact method, lowering the exploitation bar to script-kiddie level. No patch has been released by the vendor; the product appears to be an educational PHP demo with limited production presence.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis.
SQL injection in SeaCMS's WeChat integration module allows remote unauthenticated attackers to manipulate database queries through the `Content` parameter processed in `weixin/index.php`. Versions up to and including 13.6 are confirmed affected, and a public proof-of-concept exploit has been published on GitHub. The root cause is reliance on PHP's `addslashes()` for SQL sanitization - a known-insufficient defense that fails to prevent injection in many charset and connector configurations.
Arbitrary root-owned file overwrite in LiME (Linux Memory Extractor) through 1.12.0 enables local privilege escalation via symlink injection during disk-mode memory acquisition. LiME opens the operator-supplied output path from within kernel context without setting O_NOFOLLOW and without validating the path for symbolic links, meaning an unprivileged local attacker who controls the acquisition output directory can pre-position a symlink pointing to any root-owned file and have it truncated or overwritten with the memory stream. A public proof-of-concept exploit exists, confirming the technique is reproducible; no CISA KEV listing has been identified at time of analysis.
OptimiDoc Server (On-Premise) exposes cleartext credentials for integrated external services - SMTP, FTP, Active Directory, and SharePoint - directly in the HTML page source of the web administration panel. Any authenticated administrator who views the configuration pages can read these stored passwords without any additional steps. Fixed in version 26.08 per CERT-PL advisory; no public exploit or KEV listing at time of analysis.
Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.
Synchronous CSS color string parsing in colord (npm, versions prior to 2.9.4) exposes Node.js applications to event-loop denial of service through catastrophic regex backtracking (ReDoS). The ambiguous numeric pattern `([+-]?\d*\.?\d+)` used across five color-model parsers - RGB, HSL, HWB, LCH, and CMYK - allows overlapping quantifiers to partition the same digit sequence in O(n²) ways during rejection, blocking the JavaScript thread for seconds per malformed payload. An unauthenticated attacker who can supply an unbounded color string to any exposed application endpoint that calls `colord()`, `getFormat()`, `isEqual()`, `mix()`, or `contrast()` can render the service unresponsive; no public exploit code has been identified at time of analysis.
Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.
Broken access control in WWBN AVideo's unauthenticated feed/index.php RSS endpoint allows any remote attacker to bypass per-video visibility enforcement by supplying a program_id parameter, exposing unlisted and group-restricted video metadata and content URLs. The flaw is particularly severe in that empty playlist IDs trigger return of the platform's entire hidden video catalogue, making targeted enumeration trivial. No public exploit code or KEV listing confirmed at time of analysis; the CVSS 4.0 score of 6.9 reflects the unauthenticated, low-complexity network vector tempered by a limited confidentiality impact.
Broken access control on the WWBN AVideo public channel page allows unauthenticated remote visitors to retrieve full URLs of unlisted videos and thumbnails of member-only content, bypassing the operator-configured hidePrivateVideos setting. The flaw originates from hardcoded visibility flags and an undefined property check in the channel endpoint's authorization logic, rendering the platform's content-restriction model ineffective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the BSON decoding component of the MongoDB PHP Driver (all versions per CPE cpe:2.3:a:mongodb:php_driver) allows an unauthenticated remote party to cause a small quantity of adjacent process memory to be copied into an error message that is returned to application code. The disclosure is limited in scope - only a few bytes of process memory are exposed, and they surface in application-level error messages rather than being sent directly in a network response - but may inadvertently reveal stack variables, pointers, or partial secrets depending on memory layout. No public exploit code has been identified at time of analysis.
Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis.
PowerProtect Data Manager versions 20.2.0.0 and earlier contain a CWE-188 (Reliance on Data/Memory Layout) flaw that enables unauthenticated remote attackers to launch phishing attacks against users of the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the attack is network-reachable without credentials but requires high complexity and user interaction, consistent with an open-redirect or token/URL-manipulation mechanism that makes the product's trusted domain a vehicle for directing victims to attacker-controlled infrastructure. Dell has addressed this in advisory DSA-2026-368; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in MOOS-IvP SplitHandler (through version 24.8.1) allows an attacker who supplies a crafted alog file to write files outside the intended split output directory on Windows systems. By embedding backslash sequences in variable names within the alog file, the inadequate prior sanitization - which only replaced forward slashes - can be bypassed to escape the output directory boundary and append to arbitrary files. A vendor patch is available via PR#137; no public exploit or KEV listing has been identified at time of analysis.
XML External Entity (XXE) injection in Exterro FTK Imager before 8.3 allows an attacker to read arbitrary files from a forensic examiner's workstation by embedding malicious entity references and XSLT scripts within a crafted UFDR evidence archive. When an examiner previews the weaponized archive, the XML parser resolves file:// URIs and executes msxsl:script within an attacker-controlled stylesheet, exfiltrating file contents to an external endpoint via a generated image URL. The attack is particularly dangerous in forensic workflows because examiners routinely open submitted evidence archives, making file delivery a plausible social-engineering vector. No public exploit or CISA KEV listing has been identified; vendor-released patch version 8.3 is available.
XML External Entity injection in Keyence XG VisionTerminal and XG-X VisionTerminal exposes sensitive host system files when a user opens a maliciously crafted settings file. Rooted in CWE-611, the XML parser fails to restrict external entity resolution, allowing a crafted DOCTYPE declaration to cause the software to read and disclose local file contents - credentials, configuration data, or OS-level secrets accessible under the running user context. No public exploit code or active exploitation has been identified at time of analysis, and the JPCERT/JVN advisory confirms vendor awareness with a remediation reference.
Web origin policy bypass in Google Chrome for Android (prior to 152.0.7977.82) exploits a use-of-released-resource flaw (CWE-672) in the browser's mobile implementation, allowing cross-origin content manipulation via a crafted HTML page. An attacker must socially engineer a victim into visiting the malicious page, after which Chrome's Same-Origin Policy enforcement can be circumvented, resulting in high integrity impact against targeted origins. No public exploit code or CISA KEV listing exists at time of analysis; Google issued a fix in stable channel release 152.0.7977.82.
Incorrect Authorization (CWE-863) in the REST API of Dell PowerProtect Data Manager versions 20.2.0.0 and below allows a low-privileged authenticated remote attacker to bypass protection mechanisms and perform integrity-impacting actions beyond their authorized scope. The CVSS vector (PR:L, I:H, C:N, A:N) confirms the impact is confined to unauthorized modification of data or configuration - there is no confidentiality or availability exposure. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in VillaTheme's Product Variations Swatches for WooCommerce plugin (versions <= 1.1.18) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of higher-privileged users, such as administrators, when they view affected content. The flaw stems from insufficient input sanitization or output escaping of subscriber-controllable data processed by the plugin's variation swatch rendering logic. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication bar - subscriber role - expands the potential attacker pool on any store permitting public registration.
Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.
Incorrect authorization in Kibana (CWE-863) allows a low-privileged authenticated user to access data or resources beyond their intended authorization level, resulting in high-impact confidentiality breach. Affected versions are addressed in Kibana 9.4.6 and 9.5.3 per Elastic advisory ESA-2026-175. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Business Directory WordPress plugin versions 6.4.26 and earlier exposes unauthenticated endpoints that should require authorization, allowing remote attackers to perform unauthorized write operations affecting directory listings and plugin data. The root cause is CWE-862 (Missing Authorization) - the plugin omits capability or permission checks on one or more AJAX or form handlers. With a CVSS 6.5 score reflecting limited integrity and availability impact, no public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
IBM Netezza Software 11.3.0.3 through Interim Fix 002 omits the AWS S3 `ExpectedBucketOwner` validation parameter on S3 API calls, leaving the application blind to bucket ownership. An unauthenticated remote attacker who registers an S3 bucket with a name matching or colliding with the target environment's configured bucket can intercept outbound data writes or inject crafted data into Netezza's S3-backed workflows. Both confidentiality and integrity are at risk; no patch version has been independently confirmed beyond the vendor advisory, and no public exploit or active exploitation has been observed.
Missing Authorization in MountDev AI MCP Connector for WordPress (≤1.6.5) by Cascadia Web Services allows any authenticated low-privileged user to invoke plugin endpoints without proper capability checks, producing high integrity impact with no confidentiality or availability exposure. The root cause is CWE-862 (Missing Authorization), meaning the plugin registers REST or AJAX handlers that omit WordPress capability checks, permitting subscriber-level users to perform actions reserved for administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and low attack complexity lower the barrier to opportunistic exploitation.
DOM-Based XSS in WPKoi Templates for Elementor (WordPress plugin) versions through 3.7.2 allows a low-privileged authenticated attacker to inject malicious scripts that execute in victims' browsers when they view affected pages. The flaw stems from insufficient neutralization of user-supplied input during web page generation, enabling script injection into the DOM without server-side reflection. No public exploit or CISA KEV listing has been identified at time of analysis, but Patchstack has publicly documented the vulnerability, lowering the bar for exploitation.
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inject arbitrary scripts via the `skype_url` shortcode attribute, executing against any site visitor who interacts with the poisoned element. The flaw stems from a three-part sanitization failure: the field is excluded from the URL-option whitelist, the renderer explicitly bypasses `esc_url()` for Skype URLs, and the fallback `sanitize_text_field()` preserves quote characters enabling single-quoted HTML attribute breakout. Versions up to and including 4.27.6 are affected; a fix was released in 4.27.7. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.
Path traversal in parsedmarc 9.0.6 through 11.0.0 allows a network attacker who can send email to a monitored mailbox to write attacker-controlled files outside the intended samples directory. The flaw lives in save_output(), which names forensic failure report samples after the email Subject header but falls back to the raw unsanitized Subject when sanitization yields an empty string - which occurs whenever the Subject consists entirely of path separators or dots such as '../../../'. The attacker-supplied email body is then written as a dot-prefixed .eml file to an ancestor directory of the configured samples path. No public exploit identified at time of analysis; exploitation additionally requires the --output flag to be enabled.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated party who supplies document content to corrupt a small number of bytes past the end of a heap-allocated buffer. The overflow is triggered specifically when a binary BSON field is being encoded and the caller has configured a maximum output length that causes the conversion to be cut short. Impact is limited to a low-integrity write of a few bytes adjacent to the buffer - no confidentiality loss and no confirmed availability impact - but heap corruption in native C applications can have unpredictable downstream effects depending on allocator layout. No public exploit code and no CISA KEV listing exist at time of analysis.
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cause applications to silently store truncated or dropped numeric fields. CWE-681 (incorrect conversion between numeric types) triggers when an oversized text-encoded numeric value is parsed: the driver returns a success result while the resulting BSON silently shortens or omits the field entirely. Applications depending on this library for accurate numeric representation - without independent input validation - may persist corrupt data without any indication of failure, creating exploitable logical inconsistencies. No public exploit code or active exploitation has been identified at time of analysis.
IBM Qiskit SDK versions 2.1.0 through 2.5.1 crash when deserializing a specially crafted QPY (Quantum Python) payload, due to a CWE-502 deserialization flaw that triggers a segmentation fault. Local attackers who can supply malicious QPY data to a deserializing process can cause the application to crash, resulting in denial of service with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via its support portal.
Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-coded RSA private key exposure in the TP-Link Archer AX55 v4 web module allows a LAN-adjacent attacker who captures HTTP login traffic to decrypt the administrator password, since the shared private key is identical across all units of this model and the AES session key is additionally weakened. All Archer AX55 v4 firmware versions appear affected per the CPE wildcard, with a vendor patch now available via TP-Link's firmware portal. No public exploit code has been identified at time of analysis, though the cryptographic flaw is deterministic - once the static key is extracted from firmware, any captured login session can be decrypted offline.
Stored cross-site scripting via markdown HTML processing in Apache Allura through 1.20.0 permits an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users who view the compromised content - wikis, ticket comments, blog posts, or discussion threads. The vulnerability stems from insufficient sanitization of HTML embedded within markdown-rendered content across the forge platform's collaborative features. The Apache Software Foundation has released version 1.21.0 as the fix; no public exploit code or CISA KEV listing has been identified at time of analysis.
Identity injection in Rancher Manager before 2.15.1 allows a privileged Rancher user to hijack any other user's account by overwriting immutable identity provider fields. The /v3/users update API failed to strip principalIds and username from update payloads, so a user holding the update verb on users.management.cattle.io could inject an external IdP principal they control into any target account. The next time the attacker authenticates via that injected IdP principal, Rancher binds the session to the victim's account and the attacker inherits all its role bindings. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.15.1.
Stored cross-site scripting in Apache Allura allows authenticated repository contributors to inject persistent JavaScript payloads through code repository content, executing in the browsers of any user who subsequently views the affected forge pages. All releases through 1.20.0 of this open-source software forge platform are vulnerable. The Apache Security Team released version 1.21.0 in September 2026 to address this issue, as credited to researcher n0mi1k via the oss-security mailing list; no public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in WP Statistics WordPress plugin versions up to and including 14.16.11 allows remote attackers without any account to inject malicious JavaScript that executes in the browser of an authenticated user who visits the affected page. The CVSS scope change (S:C) reflects that injected scripts run in the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in Hitachi Energy RTU500 Series CMU firmware allows an unauthenticated remote attacker to crash the IEC 60870-5-104 communication process by flooding the device with General Interrogation (GI) requests at short intervals. The high-load condition triggers a NULL pointer dereference in the last entry of the enhanced message queue, causing a BCI_IEC104 fatal write error, connection interruption, and automatic restart - severing bidirectional telecontrol communication. No public exploit code has been identified at time of analysis, and exploitation requires the ability to sustain elevated request rates against a reachable IEC 104 endpoint.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.