Fluentbooking Pro
Monthly
Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.