WordPress threads due to an authorization bypass in the Fluent Booking plugin. The plugin contains a missing authorization check that permits actors without the necessary privileges to perform functions intended for higher‑level users. This flaw enables unauthorized users to gain access to booking management features, possibly altering bookings, changing user data, or retrieving sensitive information.

The vulnerability affects the Fluent Booking plugin from WP ManageNinja LLC for WordPress versions up through and including 2.5.0. Any site hosting these plugin versions is exposed, regardless of WordPress core version, until patched to 2.6.0 or later.

The CVSS score of 5.3 indicates medium severity, and no EPSS score is available. The vulnerability is not listed in CISA KEV, suggesting no current mass exploitation, but the lack of authorization controls provides a straightforward attack path through the web interface using authenticated user accounts or potentially unauthenticated users if the plugin exposes public endpoints. Based on the description, it is inferred that the likely attack vector is via the plugin’s web interface using an authenticated user account. Administrators should prioritize patching given the clear possibility of unauthorized data modification.