CVE-2025-13756: medium-severity vulnerability in techjewel Fluent Booking – The Ultimate…
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management
Published · Updated
Follow this CVE+ Monitor Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.2%
The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
techjewel · Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar SolutionRelated CVEs — techjewel Fluent Booking – The Ultimate…
In the same product, most dangerous first.