EUVD-2026-40264
GHSA-fvjp-rchx-7wr5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-accessible endpoint; requires Calendar Manager role (PR:H); only confidentiality is impacted via PII/payment data exfiltration; no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
AnalysisAI
Broken object-level authorization in the Fluent Booking WordPress plugin (all versions before 2.1.2) allows any user holding the Calendar Manager role to export attendee PII - including names, email addresses, phone numbers, physical addresses, and payment information - from calendar groups they do not own. The flaw resides in the plugin's attendee export endpoint, which accepts a caller-supplied group_id without verifying the requesting user's ownership of that group. A publicly available proof-of-concept exploit exists per WPScan reporting; however, this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed broad exploitation. The CVSS score of 4.9 (Medium) reflects the high-privilege prerequisite, though the sensitivity of the exposed data - including payment details - elevates real-world business impact beyond what the numeric score alone suggests.
Technical ContextAI
Fluent Booking is a WordPress scheduling and appointment plugin. The vulnerable component is a data export endpoint that accepts a group_id parameter to scope which calendar group's attendee records are returned. The root cause is a missing authorization check: the server performs no server-side comparison between the authenticated user's assigned calendar groups and the group_id supplied in the request, a classic Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) pattern. Although CWE is listed as N/A in the advisory, this aligns most closely with CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-284 (Improper Access Control). The affected CPE is cpe:2.3:a:unknown:fluent_booking:*:*:*:*:*:*:*:* covering all versions prior to 2.1.2. Because WordPress plugins share the same application process and database, a privileged-but-scoped role such as Calendar Manager can trivially enumerate integer group_ids to harvest cross-tenant data within the same WordPress installation.
RemediationAI
Update the Fluent Booking WordPress plugin to version 2.1.2 or later, which introduces server-side ownership verification on the group_id parameter before returning export data. This is confirmed as the vendor-released fix per the WPScan advisory (https://wpscan.com/vulnerability/f28759e0-f15e-4014-b0d1-8b58bf412b49/) and EUVD-2026-40264. As an interim compensating control where immediate patching is not possible, restrict the Calendar Manager role to only fully trusted internal users and audit current role assignments - removing the role from any external, contractor, or semi-trusted accounts eliminates the attack surface entirely, since the vulnerability requires at minimum that role. Additionally, consider temporarily disabling the attendee export functionality at the WAF or WordPress permission level if the feature is not in active use, noting the trade-off that legitimate exports will also be blocked. Review WordPress audit logs for unexpected export endpoint calls to assess whether exploitation may have already occurred.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today