Vulnerability · Published Jun 30, 2026 · Assigned by WPScan

CVE-2026-9576Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export

Medium 4.9

In plain English

A medium-severity security flaw in Fluent Booking from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Fluent Booking	0 – before 2.1.2

References

https://wpscan.com/vulnerability/f28759e0-f15e-4014-b0d1-8b58bf412b49/ exploit, vdb-entry, technical-description