CVE-2026-105072 in FluentBooking Pro Plugin
Summary
by MITRE • 10/06/2026
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as an unbroken access control issue within FluentBooking Pro versions prior to 2.5.0 represents a critical failure in the application's authentication and authorization mechanisms, allowing attackers to perform administrative actions without valid credentials. This flaw is fundamentally rooted in CWE-639, which describes issues related to unauthorized privilege escalation or bypassing of authentication controls through improper access control enforcement. In the context of this specific plugin for WordPress, the security architecture failed to adequately verify user permissions before processing sensitive requests that modify booking configurations, manage users, or alter system settings. This oversight creates a direct pathway for unauthenticated attackers to interact with protected endpoints and administrative functions as if they were legitimate administrators, thereby compromising the integrity and confidentiality of the entire web application environment.
From a technical perspective, the exploitation of this vulnerability typically involves crafting specific HTTP requests that target internal API endpoints or AJAX handlers which lack proper nonce verification or capability checks for non-logged-in users. By manipulating these request parameters, an attacker can execute actions such as creating new administrator accounts, modifying existing booking data, deleting records, or changing plugin configurations without ever logging into the WordPress dashboard. This type of attack aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of account manipulation where attackers create backdoor accounts to maintain persistent access even if initial entry points are patched. The lack of server-side validation means that client-side security measures or simple browser-based restrictions are insufficient to prevent exploitation, as the vulnerability resides entirely within the backend logic processing these requests.
The operational impact of this broken access control is severe and multifaceted, affecting not only the immediate functionality of the booking system but also the broader security posture of the hosting environment. An attacker gaining administrative privileges can exfiltrate sensitive customer data including names, contact information, payment details, and appointment schedules, leading to significant privacy violations and potential regulatory non-compliance with standards such as GDPR or CCPA. Furthermore, the ability to modify plugin settings allows for further exploitation vectors, such as injecting malicious scripts into booking forms for cross-site scripting attacks against visitors or altering database configurations to facilitate SQL injection in other parts of the application. In many cases, this level of access serves as a foothold for more advanced attacks, including web shell deployment and lateral movement within the server infrastructure, ultimately resulting in complete system compromise and potential downtime due to defacement or ransomware installation.
Mitigation strategies must prioritize immediate remediation through software updates alongside robust defensive configurations. The primary recommendation is to upgrade FluentBooking Pro to version 2.5.0 or later, where these access control flaws have been addressed by implementing strict capability checks for all administrative actions and ensuring that sensitive endpoints require valid authentication tokens. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include restricting access to the WordPress admin area via IP whitelisting using web application firewalls or server-level configurations like .htaccess rules. Additionally, enforcing strong password policies and enabling two-factor authentication for all administrative accounts adds a layer of defense-in-depth that can mitigate the risk if an attacker attempts to exploit this vulnerability to create new credentials. Regular security audits and penetration testing should be conducted to identify similar access control weaknesses across other plugins and themes installed on the same WordPress instance, ensuring a holistic approach to web application security management.