CVE-2026-9576: Fluent Booking Authorization Bypass Exposes Attendee PII

Technical summary

CVE-2026-9576 is an authorization bypass vulnerability in Fluent Booking versions before 2.1.2. The export endpoint fails to validate ownership of the requested group_id parameter before returning attendee data. The vulnerability exists in an authenticated context—attackers must hold at least the Calendar Manager role—but the access control check is absent entirely, permitting lateral data extraction across booking groups. The flaw exposes personally identifiable information and payment records without modification or denial-of-service impact.

Business impact

Organizations using Fluent Booking for event or appointment management face customer trust and regulatory compliance risks. Exposure of attendee PII and payment information could trigger notification obligations under GDPR, CCPA, and similar frameworks. The vulnerability enables internal actors with Calendar Manager privileges to harvest sensitive attendee data, creating potential for competitive intelligence gathering, secondary data sales, or social engineering attacks. Reputational damage from a data breach disclosure involving customer payment details could be significant.

Affected systems

The Fluent Booking WordPress plugin versions before 2.1.2 are affected. Organizations should audit their installed version and identify all users with the Calendar Manager role, as these are the only accounts capable of exploiting this flaw. Sites running version 2.1.2 or later are not affected.

Exploitability

Exploitation requires valid WordPress authentication with at least Calendar Manager role privileges. No internet-facing exploitation is possible without account access. The attack is straightforward once authenticated: the attacker simply requests the export endpoint with an arbitrary group_id parameter that they do not own. The CVSS score of 4.9 (Medium severity) reflects the high barrier to entry (privileged account required) offset by high confidentiality impact. This is not a zero-click or zero-auth vulnerability.

Remediation

Fluent Booking has released version 2.1.2 with authorization checks added to the export endpoint. All installations should upgrade immediately. Additionally, organizations should audit recent export activity logs to identify whether Calendar Managers have accessed groups outside their assigned scope, as this may indicate prior compromise or misuse.

Patch guidance

Update the Fluent Booking plugin to version 2.1.2 or later through the WordPress plugin update mechanism or by direct download from the official plugin repository. Verify the update installation by confirming the plugin version in WordPress admin > Plugins. No configuration changes are required post-patch. Test export functionality on your largest calendar group to confirm no operational regression.

Detection guidance

Monitor WordPress access logs for export endpoint requests from Calendar Manager accounts. Look for requests to the export function with group_id parameters belonging to different users or departments. Enable audit logging in Fluent Booking if available. Check the user meta or role assignment tables for unexpected Calendar Manager role grants. Examine attendee export files in your file system or backups for access timestamps that don't align with known business operations.

Why prioritize this

Although classified as Medium severity, prioritization depends on organizational context. If your Fluent Booking instance manages high-value event registrations, payment information, or sensitive customer lists, this should be treated as High priority because the vulnerability directly exposes PII and financial data to internal actors. The low exploit complexity and authenticated-but-privileged attack vector suggest patching within 1–2 weeks. Organizations with strict compliance requirements (healthcare, finance) should accelerate timelines.

Risk score, explained

CVSS 3.1 score of 4.9 reflects: (1) Network Attack Vector—publicly accessible WordPress admin interfaces; (2) Low Attack Complexity—no special conditions required beyond authentication; (3) High Privilege Required—Calendar Manager role is a barrier; (4) High Confidentiality Impact—full PII and payment data exposure; (5) No Integrity or Availability impact. The score is anchored by the authentication requirement, but the sensitivity of exposed data warrants heightened concern relative to the numerical score alone.

Frequently asked questions