Vulnerabilities / Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution / WPSEC-2026-2589
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Unauthenticated Sensitive Information Exposure of Paid Meeting Location via Confirmation Page and ICS Download
Medium 5.3
CWE-200Fixed in 2.6.0
- ID
- WPSEC-2026-2589
- Plugin
- Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution (fluent-booking)
- Affected
- all versions before 2.6.0
- Remediation
- Update to 2.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Booking plugin for WordPress is vulnerable to Sensitive Information Exposure via the booking confirmation response, the booking confirmation page and its ICS calendar download in all versions up to, and including, 2.5.0. This is due to the meeting location being included for bookings still waiting for online payment. This makes it possible for unauthenticated attackers to book a paid event without paying and obtain the meeting location, such as a generated video meeting link or a host location kept off the public booking page, and so join a paid meeting.
References
- https://wpsec.com/vuln/WPSEC-2026-2589/
- https://plugins.svn.wordpress.org/fluent-booking/tags/2.6.0/
- https://wordpress.org/plugins/fluent-booking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS