FluentBooking Pro CVE-2026-81273

The victim must be authenticated to the WordPress installation with a role that has permissions to perform booking management actions (typically Administrator or a custom role granted access to FluentBooking Pro functionality), and must be induced to visit an attacker-controlled web page while that authenticated session is active. The site must be running FluentBooking Pro version 2.2.4 or earlier. Exploitation is limited by the mandatory user interaction requirement (UI:R in CVSS): the attack cannot be fully automated and requires social engineering, phishing, or a malicious redirect to succeed. There are no additional server-side configuration prerequisites beyond the vulnerable plugin version being installed and active.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N scores 8.1 High. The primary real-world constraint is the required user interaction (UI:R): exploitation cannot be automated without social engineering or an ad/redirect attack to lure an authenticated administrator to a malicious page. Attack complexity is low (AC:L) once the victim is reached, with no attacker-side authentication required (PR:N). The confidentiality (C:H) and integrity (I:H) impacts indicate access to booking data and the ability to modify configurations or records - a meaningful business impact for organizations relying on this plugin for commercial scheduling. No EPSS score is available in the provided intelligence, and the absence of KEV listing suggests this is not yet being exploited at scale. The 8.1 score is technically accurate but may overstate urgency compared to fully unauthenticated vulnerabilities; the UI:R dependency is a meaningful barrier. EPSS data absence prevents further probabilistic calibration.

An attacker identifies a WordPress site running FluentBooking Pro 2.2.4 or earlier and crafts a webpage containing a hidden auto-submitting HTML form targeting a booking management endpoint. The attacker distributes the link via email or a compromised ad network targeting the site's administrators; when an admin who is simultaneously logged into WordPress visits the page, the browser submits the forged request with the admin's session cookie, executing an unauthorized action such as deleting appointments or changing booking configuration. No confirmed POC exists at time of analysis, but the technique is well-documented and requires only knowledge of the affected endpoint URL.