{
 "id": "WPSEC-2026-2589",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2589/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2589/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2589/index.md",
 "title": "Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Unauthenticated Sensitive Information Exposure of Paid Meeting Location via Confirmation Page and ICS Download",
 "description": "The Fluent Booking plugin for WordPress is vulnerable to Sensitive Information Exposure via the booking confirmation response, the booking confirmation page and its ICS calendar download in all versions up to, and including, 2.5.0. This is due to the meeting location being included for bookings still waiting for online payment. This makes it possible for unauthenticated attackers to book a paid event without paying and obtain the meeting location, such as a generated video meeting link or a host location kept off the public booking page, and so join a paid meeting.",
 "plugin": {
  "slug": "fluent-booking",
  "name": "Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution",
  "full_name": "Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution",
  "wordpress_org": "https://wordpress.org/plugins/fluent-booking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-booking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-booking"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.0",
 "remediation": "Update to 2.6.0 or later.",
 "fix_released": "2026-11-04T13:57:10+00:00",
 "published": "2026-11-05T14:50:37+00:00",
 "updated": "2026-11-05T10:27:26.669637+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2589/",
  "https://plugins.svn.wordpress.org/fluent-booking/tags/2.6.0/",
  "https://wordpress.org/plugins/fluent-booking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-booking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}