# Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Unauthenticated Sensitive Information Exposure of Paid Meeting Location via Confirmation Page and ICS Download

- **ID:** WPSEC-2026-2589
- **Plugin:** Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution (`fluent-booking`), https://wordpress.org/plugins/fluent-booking/
- **Affected versions:** all versions before 2.6.0
- **Fixed in:** 2.6.0 (Update to 2.6.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-booking
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2589/

## Description

The Fluent Booking plugin for WordPress is vulnerable to Sensitive Information Exposure via the booking confirmation response, the booking confirmation page and its ICS calendar download in all versions up to, and including, 2.5.0. This is due to the meeting location being included for bookings still waiting for online payment. This makes it possible for unauthenticated attackers to book a paid event without paying and obtain the meeting location, such as a generated video meeting link or a host location kept off the public booking page, and so join a paid meeting.

## References

- https://wpsec.com/vuln/WPSEC-2026-2589/
- https://plugins.svn.wordpress.org/fluent-booking/tags/2.6.0/
- https://wordpress.org/plugins/fluent-booking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2589/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.