https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:42:12 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-9576 <p>The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees&#39; PII (name, email, phone, address, payment information) from calendar groups they do not own.</p> <p>The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees&#39; PII (name, email, phone, address, payment information) from calendar groups they do not own.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-9576 https://vulnerability.circl.lu/vuln/ghsa-fvjp-rchx-7wr5 <p>The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees&#39; PII (name, email, phone, address, payment information) from calendar groups they do not own.</p> <p>The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees&#39; PII (name, email, phone, address, payment information) from calendar groups they do not own.</p> https://vulnerability.circl.lu/vuln/ghsa-fvjp-rchx-7wr5