CVE-2026-9576

MediumCVSS 4.9/10Last modified Jun 30, 2026

Description

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2026
Last modified: Jun 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-95774.8The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the CVE-2026-95796.3A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit o CVE-2026-95807.3A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/CVE-2026-958055.3A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the perm CVE-2026-958067.7MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper caus CVE-2026-958076.4The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, CVE-2026-958087.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the CVE-2026-958097.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St CVE-2026-95816.3A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such mani CVE-2026-958116.5Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent CVE-2026-958126.1ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to san CVE-2026-958136.1e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation