The Fluent Booking WordPress plugin contains an Improper Access Control weakness that allows a user with the Calendar Manager capability to export attendee data without verifying ownership of the calendar group. This missing authorization check results in an Information Exposure flaw that leaks personally identifiable information such as names, emails, phone numbers, addresses, and payment data for attendees belonging to groups that the requester does not own. The direct leakage of sensitive user data is a clear violation of privacy expectations.

Vulnerable versions of the Fluent Booking plugin are those released before 2.1.2. Any WordPress installation that has a pre‑2.1.2 version of this plugin installed is affected. The flaw is specific to the plugin’s export endpoint and does not depend on other components or external systems.

The exploit requires the user to already possess the Calendar Manager role. While the role is not a default administrator level, users in this role can legally perform calendar management functions, making the attack vector realistic in a compromised site environment. The CVSS score of 4.9 indicates a moderate impact if an attacker can obtain the data. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, which suggests no confirmed exploitation to date. Nevertheless, a privacy breach remains a concern.