CVE-2026-9576
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Jun 30, 2026
Vendor
unknown
Description
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.