{"id":"CVE-2026-121781","kind":"vulnerability","aliases":["CVE-2026-121781"],"related":[],"title":"Fluent Booking WordPress plugin: missing authorization check through version 2.5.0","description":"Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.","summary":"Fluent Booking, a WordPress scheduling plugin by WP ManageNinja LLC, has a missing authorization check in versions up to and including 2.5.0. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not use.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluent-booking","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Fluent Booking plugin version in the WordPress admin under Plugins; the sources say the issue affects versions through `2.5.0`.","fix":null,"status":"open","published_at":"2026-11-07T09:17:14+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:47:59+00:00","updated_at":"2026-11-07T09:47:59+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-07T09:47:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fluent Booking WordPress plugin: missing authorization check through version 2.5.0","impact":"medium","summary":"Fluent Booking, a WordPress scheduling plugin by WP ManageNinja LLC, has a missing authorization check in versions up to and including 2.5.0. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not use.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","fluent-booking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to booking functions the plugin should restrict","analyst_note":"Find the NVD or WPScan write-up for CVE-2026-121781 to confirm the affected endpoint, required role, and whether a patched version after 2.5.0 exists.","how_to_check":"- Check the installed Fluent Booking plugin version in the WordPress admin under Plugins; the sources say the issue affects versions through `2.5.0`.\n- unknown for any further check: the sources do not describe the affected endpoints or settings.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Fluent Booking WordPress plugin through version 2.5.0 are potentially exposed, and the sources say the issue relates to incorrectly configured access control levels. Sites that do not run this plugin can skip it. The sources do not say which roles or settings are required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4221,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121781':13A,16A '-2026':12A,15A '2.5.0':10A,43B,90C 'access':53B,79C 'affect':84C 'allow':75C 'attack':48B 'author':6A,35B,64C 'book':2A,19B,23B,71C,74C,86C 'check':7A,36B 'configur':52B,78C 'control':54B,80C 'cve':11A,14A 'exploit':50B,76C 'fluent':1A,18B,22B,70C,73C,85C 'fluent-book':17B,72C 'function':58B 'includ':42B 'incorrect':51B,77C 'issu':83C 'level':55B 'levels.this':82C 'llc':31B,69C 'manageninja':30B,68C 'miss':5A,34B,63C 'n/a':88C 'plugin':4A,27B 'reach':57B 'say':46B 'schedul':26B 'secur':81C 'sourc':45B 'use':62B 'version':9A,38B 'vulner':65C 'wordpress':3A,21B,25B 'wp':29B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Fluent Booking WordPress plugin through version 2.5.0 are potentially exposed, and the sources say the issue relates to incorrectly configured access control levels. Sites that do not run this plugin can skip it. The sources do not say which roles or settings are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fluentbooking","medium","other","wordpress"],"campaign_type":null,"search_a":"'-121781':13A,16A '-2026':12A,15A '2.5.0':10A 'author':6A 'book':2A 'check':7A 'cve':11A,14A 'fluent':1A 'miss':5A 'plugin':4A 'version':9A 'wordpress':3A","search_b":"'2.5.0':43B 'access':53B 'attack':48B 'author':35B 'book':19B,23B 'check':36B 'configur':52B 'control':54B 'exploit':50B 'fluent':18B,22B 'fluent-book':17B 'function':58B 'includ':42B 'incorrect':51B 'level':55B 'llc':31B 'manageninja':30B 'miss':34B 'plugin':27B 'reach':57B 'say':46B 'schedul':26B 'sourc':45B 'use':62B 'version':38B 'wordpress':21B,25B 'wp':29B","search_c":"'2.5.0':90C 'access':79C 'affect':84C 'allow':75C 'author':64C 'book':71C,74C,86C 'configur':78C 'control':80C 'exploit':76C 'fluent':70C,73C,85C 'fluent-book':72C 'incorrect':77C 'issu':83C 'levels.this':82C 'llc':69C 'manageninja':68C 'miss':63C 'n/a':88C 'secur':81C 'vulner':65C 'wp':67C","first_public_at":"2026-11-07T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121781","severity":null,"published_at":"2026-11-07T09:17:14+00:00","modified_at":"2026-11-07T09:17:14+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}