{"id":"CVE-2026-105072","published":"2026-10-06T06:16:59.313","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-booking-pro/vulnerability/wordpress-fluentbooking-pro-plugin-2-5-0-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"FluentBooking Pro versions before 2.5.0 suffer from unauthenticated broken access control that allows attackers to modify booking data without any authentication. This vulnerability enables unauthorized users to manipulate reservations, potentially leading to double-booking, revenue loss, or data corruption.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability allows full write access to booking data from any unauthenticated user via exposed API endpoints.","blast_radius":"The impact could be significant across all FluentBooking Pro installations under version 2.5.0, potentially affecting multiple bookings and reservation systems that rely on this plugin.","remediation":"Upgrade to version 2.5.0 or later to remediate this broken access control vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","booking","api"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:02:37.060Z"}}