The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fluent Booking Plugin | — | Update fluent-booking plugin to version 2.1.2, or a newer patched version | Oct 30, 2026 | Jun 9, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub