CVE-2026-9576 Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export
Calendar Manager users can access sensitive attendee PII from unowned calendar groups due to missing ownership verification in the export endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9576?
CVE-2026-9576 is a medium-severity missing authorization vulnerability in Unknown Fluent Booking, published on 30 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
Which versions are affected by CVE-2026-9576?
How do I fix CVE-2026-9576?
No fix has been published for CVE-2026-9576 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-9576 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9576 exists.
Sources
Also known as GHSA-fvjp-rchx-7wr5.