Executive brief
Fluent Booking is a WordPress plugin used to manage appointments and scheduling. A security flaw allows users with 'Calendar Manager' permissions to download sensitive personal information from calendar groups they do not own. This data includes names, email addresses, phone numbers, physical addresses, and payment details of attendees, potentially leading to privacy violations and data breaches.
Technical details
The Fluent Booking plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) / Sensitive Information Disclosure in its attendee export functionality. The 'fluent_booking_export_hosts' AJAX action fails to validate if the requesting user has ownership or authorized access to the 'group_id' parameter provided in the request. An authenticated attacker with at least 'Calendar Manager' privileges can exploit this by sending a crafted POST request to 'admin-ajax.php' with an arbitrary 'group_id'. Successful exploitation results in the disclosure of a CSV file containing PII, including names, emails, phone numbers, addresses, and payment information of attendees. This issue is fixed in version 2.1.2.
Affected products
- WPManageNinja Fluent Booking < 2.1.2
Timeline
- 2026-06-09: disclosed: Publicly published via WPScan
- 2026-06-30: advisory: NVD publication date
- 2026-06-09: patched: Fixed in version 2.1.2