FluentBooking Pro CVE-2026-105072

Requires only that a vulnerable FluentBooking Pro installation (version below 2.5.0) be deployed on an internet-reachable WordPress site; per AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no non-default configuration are needed to reach the flawed authorization check. The primary limiting factors are that the target must be running the paid Pro edition at a version earlier than 2.5.0 and the site must be network-accessible to the attacker; impact is confined to integrity (I:H, C:N/A:N), i.e. unauthorized modification or invocation of booking functionality rather than data disclosure or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication or user interaction, scored 7.5 and driven entirely by an integrity impact (I:H) with no confidentiality or availability effect (C:N/A:N) - consistent with CWE-862 Missing Authorization, where an unauthenticated actor reaches a privileged action or endpoint that should be access-controlled. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is a Patchstack research advisory. This means the inherent exploitability is high (trivial, unauthenticated, remote) but observed real-world exploitation signal is currently absent, making this a credible patch priority for exposed WordPress sites rather than an emergency 'exploited-now' item. Note the limits: the integrity-only impact means this is likely unauthorized data modification or action invocation rather than full site takeover or data theft; the exact affected endpoint is not detailed in the input, so the concrete blast radius should be verified against the Patchstack advisory.

An unauthenticated attacker sends a crafted HTTP request directly to a FluentBooking Pro endpoint that fails to enforce authorization, invoking a privileged booking action or modifying state they should not be able to reach. Because no authentication, user interaction, or special timing is required (AV:N/AC:L/PR:N/UI:N), the request can be issued by anyone who can reach the WordPress site. No public exploit code is identified at time of analysis, but the low complexity makes independent development straightforward.