CVE-2026-9576 — Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export

CVE-2026-9576

Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export PUBLISHED

Description (CNA)

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.

Affected (CNA)

Vendor / product	Versions
Unknown / Fluent Booking	affected 0 before 2.1.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f28759e0-f15e-4014-b0d1-8b58bf412b49/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.