FluentBooking Pro CVE-2026-84766

Exploitation requires that the target WordPress site runs FluentBooking Pro version 2.2.1 or earlier and that the attacker can identify and satisfy the high-complexity spoofing condition (AC:H) specific to this bypass - the precise technical condition (e.g., a specific header, forged nonce format, or timing dependency) is not detailed in available intelligence. The attack is network-accessible with no authentication (PR:N) and no user interaction (UI:N), meaning no victim action is needed once the attacker determines the spoofing mechanism. Exploitation is limited by: the AC:H complexity requirement (conditions are not trivially repeatable), absence of any confidentiality impact (attacker cannot extract secrets), and scope-unchanged nature (compromise is limited to the booking plugin's own data). Standard WordPress hardening such as restricting plugin-facing REST API endpoints would reduce exposure.

The CVSS 3.1 score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a nuanced risk profile: while the attack is remotely executable without authentication or user interaction, the AC:H constraint significantly reduces exploitability at scale - an attacker must satisfy conditions that are not always reproducible on demand. The integrity impact is rated High with zero confidentiality or availability consequence, suggesting successful exploitation enables unauthorized modification of booking data, appointment records, or scheduling state rather than credential theft or service disruption. No EPSS data was provided and no KEV listing exists, consistent with the medium CVSS score and no public exploit identified at time of analysis. There is no indication of active exploitation. For organizations running this plugin in high-volume booking environments, the integrity risk warrants prompt patching, but the AC:H factor means opportunistic mass exploitation is unlikely. No EPSS score or POC details were provided in the source intelligence, limiting quantitative exploitation probability assessment.

An attacker sends a crafted network request to the FluentBooking Pro plugin endpoint, supplying spoofed identity or authentication material (per CWE-290) that satisfies the plugin's auth check without valid credentials. If the required AC:H conditions are met - such as a specific header, token format, or application state - the attacker gains the ability to create, modify, or cancel bookings as if authenticated, potentially disrupting scheduling workflows or injecting fraudulent reservations. No public exploit code has been identified at time of analysis.