What is GHSA-fvjp-rchx-7wr5?

GHSA-fvjp-rchx-7wr5 is a security advisory published by GitHub Security Advisories with Medium severity. The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested...

Which CVE IDs does GHSA-fvjp-rchx-7wr5 cover?

GHSA-fvjp-rchx-7wr5 covers the following CVE IDs: CVE-2026-9576. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fvjp-rchx-7wr5?

GHSA-fvjp-rchx-7wr5 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-fvjp-rchx-7wr5MediumCVSS 4.9

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested...

Vendor

GitHub Security Advisories

Published

June 30, 2026

Last Modified

June 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-9576 →

📋 Description

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-9576
https://wpscan.com/vulnerability/f28759e0-f15e-4014-b0d1-8b58bf412b49
https://github.com/advisories/GHSA-fvjp-rchx-7wr5