CVE-2026-9576

Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export

Medium · published June 30, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.8th percentile
Published
2026-06-30T06:00Z
EPSS history
Timeline
  • 30 JUN 06:00Z
    Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export
    cvelistv5