CVE-2025-13756
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.
Risk Assessment
An attacker with low privileges can import and modify calendars, potentially leading to unauthorized schedule changes or information disclosure. This may disrupt site operations and compromise data integrity.
Recommendation
Update the Fluent Booking plugin to a version later than 1.9.11 if available. If not, consider disabling the plugin until a fix is released.
Other vulnerabilities in Fluent Booking
See all- CVE-2026-9576Medium
The Fluent Booking WordPress plugin before version 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint. Users with at least the Calendar Manager role can retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
- CVE-2025-67597Medium
The Fluent Booking plugin (fluent-booking) in versions up to and including 1.9.11 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS