CVE-2025-67597
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Fluent Booking plugin (fluent-booking) in versions up to and including 1.9.11 contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may perform actions they should not be authorized to do, potentially leading to unauthorized access or data modification. This affects WordPress installations with the vulnerable plugin version.
Recommendation
Update the Fluent Booking plugin to a version newer than 1.9.11. Check whether any unauthorized configuration changes have occurred.
Other vulnerabilities in Fluent Booking
See all- CVE-2026-9576Medium
The Fluent Booking WordPress plugin before version 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint. Users with at least the Calendar Manager role can retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
- CVE-2025-13756Medium
The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.
Original NVD description (English source)
Missing Authorization vulnerability in Shahjahan Jewel Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through <= 1.9.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS